21 Jan Security Advisory – SOS-10-001 – TheGreenBow VPN Client (policy) Local Stack Overflow Vulnerability
Release Date: 21-Jan-2010
Last Update: 21-Jan-2010
Vendor Notification Date: 11-Dec-2009
Product: TheGreenBow VPN Client
Platform: Microsoft Windows
Affected versions: 4.65.003, 4.51.001 verified and possibly others
Severity Rating: High
Impact: System Access
Attack Vector: Local
Solution Status: Vendor patch
CVE reference: Not yet assigned
TheGreenBow is an IPsec VPN client that sets up a secure channel for data transport.
TheGreenBow VPN Client is vulnerable to a local stack based buffer overflow which can lead to the compromise of a vulnerable system.
The vulnerability is caused due to a boundary error when processing certain sections of tgb (policy) files. Passing an overly long string to “OpenScriptAfterUp” will trigger the overflow.
Successful exploitation results in the execution of arbitrary code.
Please refer to the PDF version of this advisory for proof of concept code examples.
A patch is available from the vendor (unverified) and will be included in the next release.
Sense of Security Labs.