Full Disclosure mailing list archives
(Reprise License Manager) RLM 14.2 - Authenticated Buffer Overflow
From: Gionathan Reale via Fulldisclosure <fulldisclosure () seclists org>
Date: Sun, 5 Dec 2021 23:25:17 +0100 (CET)
# Product: Reprise License Manager 14.2 # Vendor: Reprise Software # CVE ID: CVE-2021-44154 # Vulnerability Title: Authenticated Buffer Overflow # Severity: High # Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard # Date: 2021-11-25 ############################################################# Introduction: By using an authenticated account, an attacker can write a payload to /goform/edit_opt, which will then be triggered when running the diagnostics (via /goform/diagnostics_doit), resulting in a buffer overflow. Vulnerability: When writing to options within RLM, if an input is longer than 1024 chars it will result in a buffer overflow, allowing either a secfault, crashing the program, or potentially resulting in RCE. Recommendation: Validate input lengths before copying into a buffer. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- (Reprise License Manager) RLM 14.2 - Unauthenticated User Enumeration Gionathan Reale via Fulldisclosure (Dec 07)
- (Reprise License Manager) RLM 14.2 - Unauthenticated Password Change Gionathan Reale via Fulldisclosure (Dec 07)
- (Reprise License Manager) RLM 14.2 - Unauthenticated Session Hijacking Gionathan Reale via Fulldisclosure (Dec 07)
- (Reprise License Manager) RLM 14.2 - Authenticated Buffer Overflow Gionathan Reale via Fulldisclosure (Dec 07)
- (Reprise License Manager) RLM 14.2 - Authenticated Remote Binary Execution Gionathan Reale via Fulldisclosure (Dec 07)
- (Reprise License Manager) RLM 14.2 - Unauthenticated Password Change Gionathan Reale via Fulldisclosure (Dec 07)