TSRT-06-04: eIQnetworks Enterprise Security Analyzer Topology Server Buffer Overflow Vulnerability
July 25th, 2006
CVE ID:
CVE-2006-3838
Affected Vendor:
eIQnetworks
Affected Products:
eIQnetworks Enterprise Security Analyzer
TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this vulnerability since July 24, 2006 by Digital Vaccine protection filter ID 4500. For further product information on the TippingPoint IPS:
http://www.tippingpoint.com
Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of eIQnetworks Enterprise Security Analyzer.
Authentication is not required to exploit this vulnerability.
The specific flaw exists within Topology.exe, which binds by default to
TCP port 10628. During the processing of long prefixes to the
GUIADDDEVICE, ADDDEVICE, or DELETEDEVICE command, a stack based buffer
overflow occurs.
Vendor Response:
eIQnetworks has issued an update (v2.5) to correct this vulnerability. All OEM products are patched as of version 4.6. More details can be found at:
ESA_2.5.0_Release_Notes.pdf
Disclosure Timeline:
| 2006.05.10 |
Vulnerability reported to vendor |
| 2006.07.24 |
Digital Vaccine released to TippingPoint customers |
| 2006.07.25 |
Coordinated public release of advisory |
Credit:
This vulnerability was discovered by Cody Pierce, TippingPoint Security Research Team.
