TUCoPS :: Security App Flaws

TUCoPS :: Security App Flaws :: tb11760.htm
Panda Software AdminSecure Agent Heap Overflow Vulnerability
ZDI-07-041: Panda Software AdminSecure Agent Heap Overflow Vulnerability ZDI-07-041: Panda Software AdminSecure Agent Heap Overflow Vulnerability

WkRJLTA3LTA0MTogUGFuZGEgU29mdHdhcmUgQWRtaW5TZWN1cmUgQWdlbnQgSGVhcCBPdmVyZmxv
dyBWdWxuZXJhYmlsaXR5DQpodHRwOi8vd3d3Lnplcm9kYXlpbml0aWF0aXZlLmNvbS9hZHZpc29y
aWVzL1pESS0wNy0wNDEuaHRtbA0KSnVseSAyNCwgMjAwNw0KDQotLSBDVkUgSUQ6DQpDVkUtMjAw
Ny0zMDI2DQoNCi0tIEFmZmVjdGVkIFZlbmRvcjoNClBhbmRhIFNvZnR3YXJlDQoNCi0tIEFmZmVj
dGVkIFByb2R1Y3RzOg0KUGFuZGEgQWRtaW5TZWN1cmUgMjAwNg0KDQotLSBUaXBwaW5nUG9pbnQo
VE0pIElQUyBDdXN0b21lciBQcm90ZWN0aW9uOg0KVGlwcGluZ1BvaW50IElQUyBjdXN0b21lcnMg
aGF2ZSBiZWVuIHByb3RlY3RlZCBhZ2FpbnN0IHRoaXMNCnZ1bG5lcmFiaWxpdHkgc2luY2UgSnVs
eSAyNCwgMjAwNyBieSBEaWdpdGFsIFZhY2NpbmUgcHJvdGVjdGlvbg0KZmlsdGVyIElEIDQ5NDQu
IEZvciBmdXJ0aGVyIHByb2R1Y3QgaW5mb3JtYXRpb24gb24gdGhlIFRpcHBpbmdQb2ludCBJUFM6
DQoNCiAgICBodHRwOi8vd3d3LnRpcHBpbmdwb2ludC5jb20gDQoNCi0tIFZ1bG5lcmFiaWxpdHkg
RGV0YWlsczoNClRoaXMgdnVsbmVyYWJpbGl0eSBhbGxvd3MgcmVtb3RlIGF0dGFja2VycyB0byBl
eGVjdXRlIGFyYml0cmFyeSBjb2RlIG9uDQphZmZlY3RlZCBpbnN0YWxsYXRpb25zIG9mIFBhbmRh
IEFkbWluU2VjdXJlLiBBdXRoZW50aWNhdGlvbiBpcyBub3QNCnJlcXVpcmVkIHRvIGV4cGxvaXQg
dGhpcyB2dWxuZXJhYmlsaXR5Lg0KDQpUaGUgc3BlY2lmaWMgZmxhdyBleGlzdHMgd2l0aGluIHRo
ZSBBZG1pblNlY3VyZSBhZ2VudCB3aGljaCBiaW5kcyBieQ0KZGVmYXVsdCB0byBUQ1AgcG9ydCAx
OTIyNiBvciAxOTIyNy4gV2hlbiBwcm9jZXNzaW5nIHRyYWZmaWMgb24gdGhlDQpsaXN0ZW5pbmcg
cG9ydCwgdGhlIGFnZW50IHRydXN0cyBhIHVzZXItc3VwcGxpZWQgbGVuZ3RoIHZhbHVlIGZvciBh
DQptZW1vcnkgYWxsb2NhdGlvbi4gU3BlY2lmaWMgc2l6ZSB2YWx1ZXMgY2FuIHJlc3VsdCBpbiBh
biBpbnRlZ2VyDQpvdmVyZmxvdyBhbmQgc3Vic2VxdWVudGx5IGluc3VmZmljaWVudCBhbGxvY2F0
aW9uIHNpemUuIFRoaXMgcmVzdWx0cyBpbg0KYSBoZWFwLWJhc2VkIGJ1ZmZlciBvdmVyZmxvdyB0
aGF0IGNhbiBiZSBsZXZlcmFnZSB0byBleGVjdXRlIGFyYml0cmFyeQ0KY29kZS4NCg0KLS0gVmVu
ZG9yIFJlc3BvbnNlOg0KUGFuZGEgU29mdHdhcmUgaGFzIGlzc3VlZCBhbiB1cGRhdGUgdG8gY29y
cmVjdCB0aGlzIHZ1bG5lcmFiaWxpdHkuIE1vcmUNCmRldGFpbHMgY2FuIGJlIGZvdW5kIGF0Og0K
DQogICAgaHR0cDovL3d3dy5wYW5kYXNvZnR3YXJlLmNvbS9Eb3dubG9hZC90cmVlLw0KDQotLSBE
aXNjbG9zdXJlIFRpbWVsaW5lOg0KMjAwNi4xMS4xNSAtIFZ1bG5lcmFiaWxpdHkgcmVwb3J0ZWQg
dG8gdmVuZG9yDQoyMDA3LjA3LjI0IC0gRGlnaXRhbCBWYWNjaW5lIHJlbGVhc2VkIHRvIFRpcHBp
bmdQb2ludCBjdXN0b21lcnMNCjIwMDcuMDcuMjQgLSBDb29yZGluYXRlZCBwdWJsaWMgcmVsZWFz
ZSBvZiBhZHZpc29yeQ0KDQotLSBDcmVkaXQ6DQpUaGlzIHZ1bG5lcmFiaWxpdHkgd2FzIGRpc2Nv
dmVyZWQgYnkgVGVuYWJsZSBOZXR3b3JrIFNlY3VyaXR5Lg0KDQotLSBBYm91dCB0aGUgWmVybyBE
YXkgSW5pdGlhdGl2ZSAoWkRJKToNCkVzdGFibGlzaGVkIGJ5IFRpcHBpbmdQb2ludCwgYSBkaXZp
c2lvbiBvZiAzQ29tLCBUaGUgWmVybyBEYXkgSW5pdGlhdGl2ZQ0KKFpESSkgcmVwcmVzZW50cyBh
IGJlc3Qtb2YtYnJlZWQgbW9kZWwgZm9yIHJld2FyZGluZyBzZWN1cml0eQ0KcmVzZWFyY2hlcnMg
Zm9yIHJlc3BvbnNpYmx5IGRpc2Nsb3NpbmcgZGlzY292ZXJlZCB2dWxuZXJhYmlsaXRpZXMuDQoN
ClJlc2VhcmNoZXJzIGludGVyZXN0ZWQgaW4gZ2V0dGluZyBwYWlkIGZvciB0aGVpciBzZWN1cml0
eSByZXNlYXJjaA0KdGhyb3VnaCB0aGUgWkRJIGNhbiBmaW5kIG1vcmUgaW5mb3JtYXRpb24gYW5k
IHNpZ24tdXAgYXQ6DQoNCiAgICBodHRwOi8vd3d3Lnplcm9kYXlpbml0aWF0aXZlLmNvbQ0KDQpU
aGUgWkRJIGlzIHVuaXF1ZSBpbiBob3cgdGhlIGFjcXVpcmVkIHZ1bG5lcmFiaWxpdHkgaW5mb3Jt
YXRpb24gaXMgdXNlZC4NCjNDb20gZG9lcyBub3QgcmUtc2VsbCB0aGUgdnVsbmVyYWJpbGl0eSBk
ZXRhaWxzIG9yIGFueSBleHBsb2l0IGNvZGUuDQpJbnN0ZWFkLCB1cG9uIG5vdGlmeWluZyB0aGUg
YWZmZWN0ZWQgcHJvZHVjdCB2ZW5kb3IsIDNDb20gcHJvdmlkZXMgaXRzDQpjdXN0b21lcnMgd2l0
aCB6ZXJvIGRheSBwcm90ZWN0aW9uIHRocm91Z2ggaXRzIGludHJ1c2lvbiBwcmV2ZW50aW9uDQp0
ZWNobm9sb2d5LiBFeHBsaWNpdCBkZXRhaWxzIHJlZ2FyZGluZyB0aGUgc3BlY2lmaWNzIG9mIHRo
ZQ0KdnVsbmVyYWJpbGl0eSBhcmUgbm90IGV4cG9zZWQgdG8gYW55IHBhcnRpZXMgdW50aWwgYW4g
b2ZmaWNpYWwgdmVuZG9yDQpwYXRjaCBpcyBwdWJsaWNseSBhdmFpbGFibGUuIEZ1cnRoZXJtb3Jl
LCB3aXRoIHRoZSBhbHRydWlzdGljIGFpbSBvZg0KaGVscGluZyB0byBzZWN1cmUgYSBicm9hZGVy
IHVzZXIgYmFzZSwgM0NvbSBwcm92aWRlcyB0aGlzIHZ1bG5lcmFiaWxpdHkNCmluZm9ybWF0aW9u
IGNvbmZpZGVudGlhbGx5IHRvIHNlY3VyaXR5IHZlbmRvcnMgKGluY2x1ZGluZyBjb21wZXRpdG9y
cykNCndobyBoYXZlIGEgdnVsbmVyYWJpbGl0eSBwcm90ZWN0aW9uIG9yIG1pdGlnYXRpb24gcHJv
ZHVjdC4NCg0KDQpDT05GSURFTlRJQUxJVFkgTk9USUNFOiBUaGlzIGUtbWFpbCBtZXNzYWdlLCBp
bmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzLAppcyBiZWluZyBzZW50IGJ5IDNDb20gZm9yIHRoZSBz
b2xlIHVzZSBvZiB0aGUgaW50ZW5kZWQgcmVjaXBpZW50KHMpIGFuZAptYXkgY29udGFpbiBjb25m
aWRlbnRpYWwsIHByb3ByaWV0YXJ5IGFuZC9vciBwcml2aWxlZ2VkIGluZm9ybWF0aW9uLgpBbnkg
dW5hdXRob3JpemVkIHJldmlldywgdXNlLCBkaXNjbG9zdXJlIGFuZC9vciBkaXN0cmlidXRpb24g
YnkgYW55IApyZWNpcGllbnQgaXMgcHJvaGliaXRlZC4gIElmIHlvdSBhcmUgbm90IHRoZSBpbnRl
bmRlZCByZWNpcGllbnQsIHBsZWFzZQpkZWxldGUgYW5kL29yIGRlc3Ryb3kgYWxsIGNvcGllcyBv
ZiB0aGlzIG1lc3NhZ2UgcmVnYXJkbGVzcyBvZiBmb3JtIGFuZAphbnkgaW5jbHVkZWQgYXR0YWNo
bWVudHMgYW5kIG5vdGlmeSAzQ29tIGltbWVkaWF0ZWx5IGJ5IGNvbnRhY3RpbmcgdGhlCnNlbmRl
ciB2aWEgcmVwbHkgZS1tYWlsIG9yIGZvcndhcmRpbmcgdG8gM0NvbSBhdCBwb3N0bWFzdGVyQDNj
b20uY29tLiAK