This script is Copyright (C) 2012 Tenable Network Security, Inc.
The remote Windows host has an application that is affected by
multiple remote code execution vulnerabilities.
The version of EMC AutoStart on the remote host reportedly contains
multiple remote code execution vulnerabilities :
- The EMC AutoStart ftAgent, when processing messages with
opcode 0x32 and subcode 0x04, opcode 0x32 and subcode 0x02,
opcode 0x03 and subcode 0x04, opcode 0x55 and subcode 0x16,
opcode 0x55 and subcode 0x01, opcode 0x41 and subcode 0x12,
opcode 0x32 and subcode 0x3C, opcode 0x32 and subcode 0x2A,
performs arithmetic on an unvalidated, user-supplied value
used to determine the size of a new heap buffer. This allows
a potential integer wrap to cause a heap buffer overflow.
(ZDI-12-116, ZDI-12-117, ZDI-12-118, ZDI-12-120, ZDI-12-121,
ZDI-12-122, ZDI-12-123, ZDI-12-124, respectively)
- The EMC AutoStart ftAgent, when processing messages with opcode
0x41 and subcode 0x00, uses an uninitialized stack variable in
calculating a memory pointer. Also, the function uses signed
extension and signed comparison when checking the uninitialized
stack variable, which allows arbitrary negative values to bypass
the check. This could result in corruption of a controlled memory
location, which can be leveraged to execute code under the context
of a privileged user. (ZDI-12-119)
Failed attacks may result in a denial of service.
See also :
Upgrade to version 5.4.3 or later.
Risk factor :
High / CVSS Base Score : 9.3
CVSS Temporal Score : 6.9
Public Exploit Available : false