> About
> Upcoming Advisories
> Published Advisories
> Conferences
> Resources

QUICK LINKS
> 3Com Security
> Zero Day Initiative

TSRT-06-03: eIQnetworks Enterprise Security Analyzer Syslog Server Buffer Overflow Vulnerabilities
July 25th, 2006

CVE ID:

CVE-2006-3838

Affected Vendor:

eIQnetworks

Affected Products:

eIQnetworks Enterprise Security Analyzer

TippingPoint(TM) IPS Customer Protection:

TippingPoint IPS customers have been protected against this vulnerability since July 24, 2006 by Digital Vaccine protection filter ID 4319. For further product information on the TippingPoint IPS:

   http://www.tippingpoint.com

Vulnerability Details:

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of eIQnetworks Enterprise Security Analyzer. Authentication is not required to exploit this vulnerability.

The flaw specifically exists within the Syslog daemon, syslogserver.exe, during the processing of long arguments passed through various commands on TCP port 10617. The following commands are known to be affected:

    DELTAINTERVAL
    LOGFOLDER
    DELETELOGS
    FWASERVER
    SYSLOGPUBLICIP
    GETFWAIMPORTLOG
    GETFWADELTA
    DELETERDEPDEVICE
    COMPRESSRAWLOGFILE
    GETSYSLOGFIREWALLS
    ADDPOLICY
    EDITPOLICY

The majority of the above cases result in a stack overflow and are trivial to exploit.

Vendor Response:

eIQnetworks has issued an update (v2.5) to correct this vulnerability. All OEM products are patched as of version 4.6. More details can be found at:

   ESA_2.5.0_Release_Notes.pdf

Disclosure Timeline:

2006.05.10	Vulnerability reported to vendor
2006.07.24	Digital Vaccine released to TippingPoint customers
2006.07.25	Coordinated public release of advisory

Credit:

This vulnerability was discovered by Cody Pierce, TippingPoint Security Research Team.