Vulnerability Note VU#213516
LiveData Protocol Server fails to properly handle requests for WSDL files
The LiveData Protocol Server fails to properly handle requests. This vulnerability may allow a remote attacker to execute arbitrary code.
The LiveData Protocol Server is real-time data acquisition and processing software used to record and transmit data among process control networks in SCADA environment. A vulnerability exists in the way LiveData Protocol Server handles requests for Web Services Description Language (WSDL) files that may allow a remote attacker to execute arbitrary code. According to iDefense Security Advisory 05.02.07:
By supplying a specially crafted request to the service on port 8080, an attacker is able to supply a negative length value to a strncpy call. This value is interpreted by strncpy as a very large positive value. As a result, a memory access violation occurs when attempting to write data past the end of the heap memory segment.
A remote, unauthenticated attacker may be able to execute arbitrary code or cause a denial of service.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|LiveData Inc.||Affected||-||03 May 2007|
CVSS Metrics (Learn More)
This vulnerability was reported in iDefense Security Advisory 05.02.07 .
This document was written by Chris Taschner.
- CVE IDs: CVE-2007-2489
- Date Public: 02 May 2007
- Date First Published: 03 May 2007
- Date Last Updated: 21 Jul 2008
- Severity Metric: 13.47
- Document Revision: 17
If you have feedback, comments, or additional information about this vulnerability, please send us email.