Executive Summary

Summary
Title Wyse Device Manager (WDM) HServer and HAgent contain multiple vulnerabilities
Informations
Name VU#654545 First vendor Publication 2009-10-13
Vendor VU-CERT Last vendor Modification 2009-10-16
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#654545

Wyse Device Manager (WDM) HServer and HAgent contain multiple vulnerabilities

Overview

Wyse Device Manager (WDM) Server and HAgent contain several vulnerabilities. An attacker with network access to WDM components could execute arbitrary code on vulnerable systems.

I. Description

Wyse Device Manager (WDM, formerly known as Wyse Rapport) manages thin clients. Part of the server component (HServer) is implemented as an ISAPI filter on the Microsoft Windows Internet Information Server (IIS) platform. The client component (HAgent) runs as a service on Microsoft Windows systems.

WDM components contain several vulnerabilities:

  1. HServer (hserver.dll) User-Agent header stack buffer overflow and
  2. HAgent (hagent.exe) heap overflow (both overflows are CVE-2009-0693)
  3. HAgent does not authenticate commands (CVE-2009-0695)
The first two issues are implementation defects. The third issue is caused by the lack of adequate cryptographic authentication and authorization.

II. Impact

An attacker with network access to WDM components could execute arbitrary code on a vulnerable system. The attacker could also execute unauthenticated management commands on a system running HAgent.

III. Solution

Please see Wyse Security Bulletin WSB09-01.

Enable HTTPS

Enabling HTTPS provides authentication between Hserver and HAgent nodes. HTTPS authenticates communication from an HServer host to an HAgent host. Depending on key distribution and PKI architecture, HTTPS should prevent an unauthenticated attacker from running management commands on an HAgent host.

Systems Affected

VendorStatusDate NotifiedDate Updated
WyseVulnerable2009-07-042009-07-23

References


http://osvdb.org/show/osvdb/55808
http://www.wyse.com/serviceandsupport/support/WSB09-01.zip
http://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf
http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/
http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0101.html

Credit

These vulnerabilities were analyzed and reported by Kevin Finisterre of Netragard/SNOsoft.

This document was written by Art Manion.

Other Information

Date Public:2009-07-10
Date First Published:2009-10-13
Date Last Updated:2009-10-16
CERT Advisory: 
CVE-ID(s):CVE-2009-0693; CVE-2009-0695
NVD-ID(s):CVE-2009-0693CVE-2009-0695
US-CERT Technical Alerts: 
Metric:13.51
Document Revision:23

Original Source

Url : http://www.kb.cert.org/vuls/id/654545

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-287 Improper Authentication
50 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 3

Nessus® Vulnerability Scanner

Date Description
2009-07-21 Name : The remote Windows host contains an application that is affected by a buffer ...
File : wyse_wdm_buffer_overflow.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2020-05-23 13:17:15
  • Multiple Updates
2014-02-17 12:08:04
  • Multiple Updates