Vulnerability Note VU#346278

AT&T Connect Participant Application for Windows v9.5.35 contains a stack-based buffer overflow vulnerability

Original Release date: 03 Dec 2013 | Last revised: 03 Dec 2013

Overview

AT&T Connect Participant Application for Windows v9.5.35 and possibly earlier versions contain a stack-based buffer overflow (CWE-121) vulnerability.

Description

CWE-121: Stack-based Buffer Overflow

AT&T Connect Participant Application for Windows v9.5.35 and possibly earlier versions contain a stack-based buffer overflow vulnerability. AT&T Connect allows a user to join a web conference via a web browser. When joining a conference, AT&T provides the .SVT file for the user to open. Upon opening the file, the user is able to join the conference.

An attacker can send a malformed .SVT file to a victim which can allow the attacker to run arbitrary code in the context of the logged in user.

Impact

A remote unauthenticated attacker that is able to trick a user into opening a malicious .SVT file may be able to obtain sensitive information, cause a denial of service condition, or execute arbitrary code with the privileges of the application.

Solution

Apply an Update

AT&T has released Connect Participant Application for Windows v.9.5.51 to address this vulnerability. Affected users are advised to upgrade.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
AT&TAffected12 Sep 201304 Nov 2013
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base 8.3 AV:N/AC:M/Au:N/C:P/I:P/A:C
Temporal 6.5 E:POC/RL:OF/RC:C
Environmental 1.6 CDP:ND/TD:L/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Christopher Gabriel of Telos Corporation for reporting this vulnerability.

This document was written by Adam Rauf.

Other Information

  • CVE IDs: CVE-2013-6029
  • Date Public: 12 Nov 2013
  • Date First Published: 03 Dec 2013
  • Date Last Updated: 03 Dec 2013
  • Document Revision: 30

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.