TIBCO Rendezvous vulnerability

   Original release date: June 5, 2006
   Last revised: --
   Source: TIBCO Software Inc.


Systems Affected

   TIBCO Rendezvous versions below 7.5.1

   TIBCO Runtime Agent (TRA) versions below 5.4

   TIBCO Hawk versions below 4.6.1


   The following components are affected:

     * TIBCO Rendezvous Routing Daemon (rvrd)
     * TIBCO Rendezvous Secure Routing Daemon (rvsrd)
     * TIBCO Rendezvous Secure Daemon (rvsd)
     * TIBCO Rendezvous Cache (rvcache)
     * TIBCO Rendezvous Agent (rva)


Overview

   TIBCO Rendezvous daemon components listed above contain a buffer
   overflow vulnerability in the HTTP administrative interface.
   The impact of this vulnerability may include remote execution of
   arbitrary code, information disclosure, and denial of service.


I. Description

   TIBCO has released updates which address critical vulnerabilities
   in daemon components of TIBCO Rendezvous and TIBCO Runtime Agent.
   TIBCO strongly recommends sites running the affected components to
   install the update or take mitigating action as appropriate.


II. Impact

   The impact of this vulnerability varies depending on the operating
   system, configuration options of the daemon, and the privilege
   levels of the user that invokes the daemon.

   On Unix based systems, the successful exploit will allow arbitrary
   code execution with the privileges of the user that invoked that
   daemon, with the exception of user id 0 ("root").  If the daemon
   component was invoked by user id 0, a successful exploit will
   result in access to privileges of user id 65534 ("nobody").

   On Windows based systems, the successful exploit will allow
   arbitrary code execution with the privileges of the user that
   invoked that daemon.  If the daemon component is installed as
   a system service, this will result in access to system privileges.


III. Solution

   Upgrade TIBCO Rendezvous to version 7.5.1 or above.  This is
   strongly recommended.

   If an upgrade is not possible, the following actions can mitigate
   the vulnerability:

     * Disable the HTTP administrative interface by use of the
       "-no-http" option.  This will block the vulnerability
       completely.
     * Set the administrative username and password of the daemon
       component.  This will restrict access to the vulnerability
       to users possessing administrative access to the daemon
       component.  It is also recommended that the administration
       interface be restricted to HTTPS by use of the "-https-only"
       option.
     * Restrict access to the HTTP administrative interface to users
       on the local host by use of the "-http" and "-https" options
       (example: "-http 127.0.0.1:7580 -https 127.0.0.1:7585").  This
       will restrict access to the vulnerability to users with login
       access to the host.
     * Use a user with restricted privileges to invoke the daemon
       components.
     * On Unix systems, invoke the daemon components from a chroot
       environment.  This will restrict the ability to access or
       modify information in the event of a successful exploit.


References

   http://www.tibco.com/mk/advisory.jsp


---------------------------------------------------------------------

TIBCO would like to extend its appreciation to Andrés Tarascó Acuña
of the SIA Group for discovery of this vulnerability, which has been
addressed in the 7.5.1 release.

---------------------------------------------------------------------