HP LoadRunner < 11.52 SSL Connection Handling Stack Buffer Overflow RCE
High Nessus Plugin ID 69424
Synopsis
The remote host has a software performance testing application running that is affected by a remote code execution vulnerability.
Description
The version of HP LoadRunner running on the remote host is affected by a remote code execution vulnerability due to a failure to validate the length of data before copying it into a fixed-size buffer when handling connections using SSL. A remote, unauthenticated attacker can exploit this, via a specially crafted request, to cause a stack-based buffer overflow, resulting in the execution of arbitrary code with SYSTEM privileges.
Solution
Upgrade to HP LoadRunner 11.52 or later.