ID

VAR-200702-0025

CVE

CVE-2007-0446

TITLE

HP Mercury products vulnerable to buffer overflow

DESCRIPTION

Stack-based buffer overflow in magentproc.exe for Hewlett-Packard Mercury LoadRunner Agent 8.0 and 8.1, Performance Center Agent 8.0 and 8.1, and Monitor over Firewall 8.1 allows remote attackers to execute arbitrary code via a packet with a long server_ip_name field to TCP port 54345, which triggers the overflow in mchan.dll. Authentication is not required to exploit this vulnerability.The specific flaw exists within the process magentproc.exe that binds to TCP port 54345. When parsing packets containing an overly long 'server_ip_name' field, an exploitable stack overflow may be triggered due to an an inline strcpy() within the library mchan.dll. Multiple Mercury products are prone to a stack-based buffer-overflow vulnerability because the applications fail to bounds-check user-supplied data before copying it into an insufficiently sized buffer. Failed exploit attempts will result in a denial of service. HP Mercury is an IT management software developed by Mercury acquired by HP. Authentication is not required to exploit this vulnerability. -- Vendor Response: Hewlett-Packard has issued an update to correct this vulnerability. More details can be found at: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00854250 -- Disclosure Timeline: 2006.10.27 - Vulnerability reported to vendor 2006.11.10 - Digital Vaccine released to TippingPoint customers 2007.02.08 - Coordinated public release of advisory -- Credit: This vulnerability was discovered by Eric DETOISIEN. -- About the Zero Day Initiative (ZDI): Established by TippingPoint, a division of 3Com, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. 3Com does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, 3Com provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, 3Com provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. ---------------------------------------------------------------------- Secunia is proud to announce the availability of the Secunia Software Inspector. The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor. Try it out online: http://secunia.com/software_inspector/ ---------------------------------------------------------------------- TITLE: HP Mercury Products Long "server_ip_name" Buffer Overflow SECUNIA ADVISORY ID: SA24112 VERIFY ADVISORY: http://secunia.com/advisories/24112/ CRITICAL: Moderately critical IMPACT: System access WHERE: >From local network SOFTWARE: Mercury LoadRunner Agent 8.x http://secunia.com/product/13450/ Mercury Monitor over Firewall 8.x http://secunia.com/product/13449/ Mercury Performance Center Agent 8.x http://secunia.com/product/13448/ DESCRIPTION: A vulnerability has been reported in various HP Mercury products, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error within MCHAN.DLL when parsing packets sent to MAGENTPROC.EXE on port 54345/TCP. -- Mercury LoadRunner Agent 8.1 FP4 -- NT: http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/c337892f322b2311 c22572670060b795?OpenDocument AIX, HP, Solaris, Linux: http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/6d7ce88c0d5c4b36 c225726a004a94a2?OpenDocument -- Mercury LoadRunner Agent 8.1 SP1, FP1, FP2, FP3 -- Update to 8.1 FP4 and apply patches listed above. -- Mercury LoadRunner Agent 8.1 GA -- NT: http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/7cd789640e496c34 c225726700613486?OpenDocument AIX, HP, Solaris, Linux: http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/f2de896609dd7efb c225726a004af033?OpenDocument -- Mercury LoadRunner Agent 8.0 GA -- NT: http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/fa4a48afea2f8198 c22572670061bbe7?OpenDocument AIX, HP, Solaris, Linux: http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/5de153e30789fa4a c225726a004b2354?OpenDocument -- Mercury Performance Center Agent 8.1 FP4 -- NT: http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/ae5d9a48a163fbb4 c225726a004c7831?OpenDocument AIX, HP, Solaris, Linux: http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/34e894d8d8a1b941 c225726a004ff335?OpenDocument -- Mercury Performance Center Agent 8.1 FP1, FP2, FP3 -- Update to version 8.1 FP4 and apply patches listed above. -- Mercury Performance Center Agent 8.1 GA -- NT: http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/0831f8b0bd9d9619 c225726a004cf7fe?OpenDocument AIX, HP, Solaris, Linux: http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/a7333913152e65e1 c225726a005035e4?OpenDocument -- Mercury Performance Center Agent 8.0 GA -- Update to version 8.1 GA and apply patches listed above. -- Mercury Monitor over Firewall 8.1 -- NT: http://webnotes.merc-int.com/patches.nsf/c4d68388a23535dc422567d0004bbae2/c9b9924b3206614f c225726a004ded7d?OpenDocument PROVIDED AND/OR DISCOVERED BY: Discovered by Eric Detoisien and reported via ZDI. ORIGINAL ADVISORY: HPSBGN02187 SSRT061280: http://www5.itrc.hp.com/service/cki/docDisplay.do?docId=c00854250 ZDI: http://www.zerodayinitiative.com/advisories/ZDI-07-007.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

buffer overflow

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Eric DETOISIEN

SOURCES

LAST UPDATE DATE

2024-11-23T22:24:16.297000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE