Security Advisory SSA-1106

EMC Autostart Domain Name Logging Remote Code Execution Vulnerability

Reference ID: SSA-1106
Publication date: 23.08.2011
Severity: critical
Discovered by: Sebastian Apelt

Affected products/versions: EMC AutoStart 5.3.* and 5.4.*

Description from ZDI advisory: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC AutoStart High Availability. Authentication is not required to exploit this vulnerability. The specific flaw exists within the packet error handling of the application. When building an error message to log an error, the application will use a user-supplied string from the packet as an argument to a function containing a format string. The result of this function is written to a statically sized buffer located on the stack. This will lead to code execution under the context of the service.

References:
ZDI-11-273
CVE-2011-2735
Advisory by EMC, published on securityfocus