EMC RepliStor Server Heap Overflow Vulnerability
TPTI-07-18: October 10th, 2007
TippingPoint™ IPS Customer Protection
TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 5623. For further product information on the TippingPoint IPS:
This vulnerability allows attackers to execute arbitrary code on vulnerable installations of EMC RepliStor Server. User interaction is not required to exploit this vulnerability.
The specific flaw exists in the RepliStor Server Service that listens by default on TCP port 7144. The vulnerable function trusts a user-supplied size value allowing an attacker to create an undersized buffer. A later call to recv() overflows that buffer allowing for arbitrary code execution in the context of the SYSTEM user.
EMC states: EMC has issued updates to correct this vulnerability. More details can be found in knowledge base article emc168869 available from powerlink.emc.com. EMC customers can further contact EMC Software Technical Support at 1-877-534-2867.
2007-07-20 - Vulnerability reported to vendor
2007-10-10 - Coordinated public release of advisory
This vulnerability was discovered by:
Aaron Portnoy, TippingPoint DVLabs