Kod programskog paketa HP LoadRunner uočena je sigurnosna ranjivost koja zlonamjernim korisnicima omogućava pokretanje proizvoljnog programskog koda.
Paket:
HP LoadRunner 11.x, HP LoadRunner 9.x
Operacijski sustavi:
Microsoft Windows 2000, Microsoft Windows Me, Microsoft Windows XP, Microsoft Windows Server 2003, Microsoft Windows Vista, Microsoft Windows 7
Problem:
preljev međuspremnika
Iskorištavanje:
udaljeno
Posljedica:
proizvoljno izvršavanje programskog koda
Rješenje:
ne postoji zakrpa
Izvorni ID preporuke:
SA44809
Izvor:
Secunia
Problem:
Uočena ranjivost posljedica je pogreške kod određivanja granica u parsiranju direktiva unutar Virtual User Script (USR) datoteka.
Posljedica:
Zlonamjerni, udaljeni korisnici mogu iskoristiti navedenu ranjivost za pokretanje proizvoljnog programskog koda.
Rješenje:
Trenutno još nije objavljena nadogradnja koja bi ispravila uočenu ranjivost. Zasad, korisnicima se preporuča da ne otvaraju nepouzdane USR datoteke. Korisnicima se savjetuje detaljnije čitanje izvorne preporuke.
HP LoadRunner USR File Directive Parsing Buffer Overflow Vulnerability
Secunia Advisory SA44809
Release Date 2011-06-09
Criticality level Highly criticalHighly critical
Impact System access
Where From remote
Authentication level Available in Customer Area
Report reliability Available in Customer Area
Solution Status Unpatched
Systems affected Available in Customer Area
Approve distribution Available in Customer Area
Remediation status Secunia VIM
Software:
HP LoadRunner 11.x
HP LoadRunner 9.x
Secunia CVSS Score Available in Customer Area
CVE Reference(s) No CVE references.
Description
A vulnerability has been reported in HP LoadRunner, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to a boundary error when parsing directives within a Virtual User Script (USR) file and can be exploited to cause a buffer overflow by e.g. tricking a user into opening a USR file with overly long directive strings.
Successful exploitation may allow execution of arbitrary code.
The vulnerability is reported in versions 11.0 and 9.50. Other versions may also be affected
Solution
Do not open untrusted USR files. Reportedly, the vendor will fix this in an upcoming version.
Provided and/or discovered by
US-CERT credits Jeremy Brown.
Original Advisory
US-CERT VU#987308:
https://www.kb.cert.org/vuls/id/987308
Posljednje sigurnosne preporuke