TIBCO SmartSockets vulnerability

   Original release date: January 15, 2008
   Last revised: --
   Source: TIBCO Software Inc.


Systems Affected

   TIBCO SmartSockets versions below 6.8.1

   The following components are affected:

     * TIBCO SmartSockets Server (rtserver)
     * TIBCO SmartSockets Cache (scache)
     * TIBCO SmartSockets Gateway (rtgateway)
     * TIBCO SmartSockets LiveWeb (rtweb)
     * TIBCO SmartSockets client libraries (rtipc, rtmsg, rtutil)
     * TIBCO SmartMQ Server (mqserver)


Overview

   TIBCO SmartSockets components listed above contain buffer overflow
   vulnerabilities in the processing of inbound data.  The impact of
   these vulnerabilities may include remote execution of arbitrary code,
   information disclosure, and denial of service. 


I. Description

   TIBCO has released updates which address critical vulnerabilities in
   the server and library components of the TIBCO SmartSockets.

   These vulnerabilities directly affect the SmartSockets server
   (rtserver) and applications utilizing the TipcConnAccept interface.
   These vulnerabilities may also affect applications utilizing the
   SmartSockets libraries if an attacker is able to inject data into
   the server/client TCP connection.

   TIBCO strongly recommends sites running the affected components to
   install the update or take mitigating action as appropriate.


II. Impact

   The impact of these vulnerabilities varies depending on the operating
   system and the privilege levels of the user that invokes the server or
   application.

   On Unix based systems, the successful exploit will allow arbitrary
   code execution with the privileges of the user that invoked the
   server or application.

   On Windows based systems, the successful exploit will allow arbitrary
   code execution with the privileges of the user that invoked the server
   or application.  If the server or application is installed as a system
   service, this will result in access to system privileges.


III. Solution

   Upgrade TIBCO SmartSockets to version 6.8.1 or above.  This is
   strongly recommended.

   If an upgrade is not possible, the following actions can mitigate
   the vulnerabilities:

     * Utilize a firewall to restrict access to the rtserver or
       TipcConnAccept port to trusted sources.
     * Use a user with restricted privileges to invoke the server
       or application.
     * On Unix systems, invoke the server or application from a chroot
       environment.  This will restrict the ability to access or
       modify information in the event of a successful exploit.


References

   http://www.tibco.com/mk/advisory.jsp
   CVE: CVE-2007-5655, CVE-2007-5656, CVE-2007-5657, CVE-2007-5658

----------------------------------------------------------------------

TIBCO would like to extend its appreciation to McSlibin and Sean
Larsson (iDefense Labs) for discovery of these vulnerabilities, which
have been addressed in the 6.8.1 release.

----------------------------------------------------------------------