Signature Detail

HTTP: RSA Agent Redirect Overflow

This signature detects attempts to exploit a known vulnerability against RSA Authentication Agent for Web Redirect. Attackers can send malicious data that can cause a buffer overflow leading to arbitrary remote code execution within the context of the Agent service.

Extended Description

A remote heap-based buffer overflow vulnerability exists in RSA Authentication Agent for Web. This issue is due to a failure of the application to properly bounds check user-supplied input data prior to copying it into a fixed-sized heap buffer memory region. This vulnerability allows remote attackers to execute arbitrary machine code in the context of the vulnerable server application. This reportedly occurs with 'LocalSystem' privileges, allowing the attacker to gain complete control of the targeted computer. Versions 5.0, 5.2, and 5.3 of RSA Authentication Agent for Web are vulnerable to this issue.

Affected Products

• RSA Security RSA Authentication Agent for Web 5.0.0
• RSA Security RSA Authentication Agent for Web 5.2.0
• RSA Security RSA Authentication Agent for Web 5.3.0

References

• BugTraq: 13524
• CVE: CVE-2005-1471