SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Microsoft Host Integration Server Vendors:   Microsoft
Microsoft Host Integration Server RPC Buffer Overflow Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1021043
SecurityTracker URL:  http://securitytracker.com/id/1021043
CVE Reference:   CVE-2008-3466   (Links to External Site)
Updated:  Oct 14 2008
Original Entry Date:  Oct 14 2008
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2000 SP2, 2004 SP1, 2006; and prior service packs
Description:   A vulnerability was reported in Microsoft Host Integration Server. A remote user can execute arbitrary code on the target system.

A remote user can send a specially crafted RPC request to the SNA RPC service to trigger a buffer overflow and execute arbitrary code on the target system. The code will run with the privileges of the target service.

The UUID of the affected RPC service is: ed6ee250-e0d1-11cf-925a-00aa00c006c1

The vendor was notified on May 27, 2008.

Stephen Fewer of Harmony Security reported this vulnerability via iDefense.

Impact:   A remote user can execute arbitrary code on the target system.
Solution:   The vendor has issued the following fixes:

Microsoft Host Integration Server 2000 Service Pack 2 (Server):

http://www.microsoft.com/downloads/details.aspx?familyid=11CCA58B-59A4-4E93-9EB1-19B07C290A10

Microsoft Host Integration Server 2000 Administrator Client:

http://www.microsoft.com/downloads/details.aspx?familyid=41B49291-1231-4E23-AEF7-818207453D56

Microsoft Host Integration Server 2004 (Server):

http://www.microsoft.com/downloads/details.aspx?familyid=9CA255ED-9334-4848-AF94-49EF3078CDC0

Microsoft Host Integration Server 2004 Service Pack 1 (Server):

http://www.microsoft.com/downloads/details.aspx?familyid=ECA756A1-CA56-4481-B23C-53C159A4E08C

Microsoft Host Integration Server 2004 (Client):

http://www.microsoft.com/downloads/details.aspx?familyid=92CB54E7-F4FF-40A4-99CB-6257C4D8D4CD

Microsoft Host Integration Server 2004 Service Pack 1 (Client):

http://www.microsoft.com/downloads/details.aspx?familyid=D776515C-09AA-4A04-876D-606BFC26A006

Microsoft Host Integration Server 2006 for 32-bit systems:

http://www.microsoft.com/downloads/details.aspx?familyid=1AE79DA3-EC17-4D4B-8011-D777A237AC93

Microsoft Host Integration Server 2006 for x64-based systems:

http://www.microsoft.com/downloads/details.aspx?familyid=05DA4540-4976-458A-A612-7385D78695A2

The Microsoft advisory is available at:

http://www.microsoft.com/technet/security/bulletin/ms08-059.mspx

Vendor URL:  www.microsoft.com/technet/security/bulletin/ms08-059.mspx (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (2000), Windows (2003), Windows (XP)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC