HTTP: RSA Agent Redirect Overflow

This signature detects attempts to exploit a known vulnerability against RSA Authentication Agent for Web Redirect. Attackers can send malicious data that can cause a buffer overflow leading to arbitrary remote code execution within the context of the Agent service.

Extended Description

A remote heap-based buffer overflow vulnerability exists in RSA Authentication Agent for Web. This issue is due to a failure of the application to properly bounds check user-supplied input data prior to copying it into a fixed-sized heap buffer memory region. This vulnerability allows remote attackers to execute arbitrary machine code in the context of the vulnerable server application. This reportedly occurs with 'LocalSystem' privileges, allowing the attacker to gain complete control of the targeted computer. Versions 5.0, 5.2, and 5.3 of RSA Authentication Agent for Web are vulnerable to this issue.

Affected Products

Rsa_security rsa_authentication_agent_for_web

References

BugTraq: 13524

CVE: CVE-2005-1471

Short Name

HTTP:CGI:RSA-AGENT-BOF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: RSA Agent Redirect Overflow

Extended Description

Affected Products

References

Found a potential security threat?