EMC AutoStart ftAgent Multiple Remote Code Execution Vulnerabilities (ESA-2012-020)

This script is Copyright (C) 2012-2014 Tenable Network Security, Inc.


Synopsis :

The remote Windows host has an application that is affected by
multiple remote code execution vulnerabilities.

Description :

The version of EMC AutoStart on the remote host reportedly contains
multiple remote code execution vulnerabilities :

- The EMC AutoStart ftAgent, when processing messages with
opcode 0x32 and subcode 0x04, opcode 0x32 and subcode 0x02,
opcode 0x03 and subcode 0x04, opcode 0x55 and subcode 0x16,
opcode 0x55 and subcode 0x01, opcode 0x41 and subcode 0x12,
opcode 0x32 and subcode 0x3C, opcode 0x32 and subcode 0x2A,
performs arithmetic on an unvalidated, user-supplied value
used to determine the size of a new heap buffer. This allows
a potential integer wrap to cause a heap-based buffer overflow.
(ZDI-12-116, ZDI-12-117, ZDI-12-118, ZDI-12-120, ZDI-12-121,
ZDI-12-122, ZDI-12-123, ZDI-12-124, respectively)

- The EMC AutoStart ftAgent, when processing messages with opcode
0x41 and subcode 0x00, uses an uninitialized stack variable in
calculating a memory pointer. Also, the function uses signed
extension and signed comparison when checking the uninitialized
stack variable, which allows arbitrary negative values to bypass
the check. This could result in corruption of a controlled memory
location, which can be leveraged to execute code under the context
of a privileged user. (ZDI-12-119)

Failed attacks may result in a denial of service.

See also :

http://www.securityfocus.com/archive/1/522835
http://www.zerodayinitiative.com/advisories/ZDI-12-116/
http://www.zerodayinitiative.com/advisories/ZDI-12-117/
http://www.zerodayinitiative.com/advisories/ZDI-12-118/
http://www.zerodayinitiative.com/advisories/ZDI-12-119/
http://www.zerodayinitiative.com/advisories/ZDI-12-120/
http://www.zerodayinitiative.com/advisories/ZDI-12-121/
http://www.zerodayinitiative.com/advisories/ZDI-12-122/
http://www.zerodayinitiative.com/advisories/ZDI-12-123/
http://www.zerodayinitiative.com/advisories/ZDI-12-124/
http://www.zerodayinitiative.com/advisories/ZDI-12-159/
http://www.zerodayinitiative.com/advisories/ZDI-12-160/
http://www.zerodayinitiative.com/advisories/ZDI-12-161/
http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0281.html
http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0282.html
http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0283.html

Solution :

Upgrade to version 5.4.3 or later.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 6.9
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: Gain a shell remotely

Nessus Plugin ID: 61491 ()

Bugtraq ID: 53682

CVE ID: CVE-2012-0409