{"vuid":"VU#790533","idnumber":"790533","name":"RSA Authentication Agent for Web for IIS vulnerable to heap overflow via overly large \"chunk\"","keywords":["RSA","SecurID Web Agent","heap overflow","DoS","denial of service","remote code execution","chunk","chunked-encoding","iis"],"overview":"RSA Authentication Agent for Web for IIS contains a heap overflow in the handling of chunked input. This could allow a remote, unauthenticated attacker to execute arbitrary code on the server.","clean_desc":"RSA Authentication Agent software provides access control for networks, web applications, and operating systems. It is used in conjunction with RSA SecurID Authenticators and Authentication Manager software. RSA Authentication Agent for Web for IIS contains a heap overflow vulnerability. Using chunked transfer-encoding it is possible to overwrite portions of heap memory, allowing execution of arbitrary code. Exploit code for this vulnerability is publicly available.","impact":"A remote, unauthenticated attacker may be able to execute arbitrary code  with LocalSystem privileges on the vulnerable server.","resolution":"Upgrade or patch\nAccording to RSA Security: To get this new patch and documentation, log on to RSA SecurCare Online at https://knowledge.rsasecurity.com and click \"Downloads\" in the left navigation menu. Then, click \"Fixes by Product\", click \"RSA SecurID\", and \"Authentication Agent 5.x\", and select the downloads and documentation that pertain to your environment.","workarounds":"","sysaffected":"","thanks":"This vulnerability was reported by Gary O'leary-Steele of \nSec-1","author":"This document was written by Will Dormann, based on the Sec-1 security advisory .","public":["https://knowledge.rsasecurity.com","http://secunia.com/advisories/15222","http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.6.1","http://www.securityfocus.com/bid/13524","http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0039.html","http://www.rsasecurity.com/node.asp?id=2807&node_id","http://www.securityfocus.com/bid/13524"],"cveids":["CVE-2005-1471"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2005-05-06T13:53:21Z","publicdate":"2005-05-06T00:00:00Z","datefirstpublished":"2005-05-11T14:54:32Z","dateupdated":"2005-11-07T15:46:14Z","revision":11,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"20","cam_exploitation":"0","cam_internetinfrastructure":"10","cam_population":"10","cam_impact":"20","cam_easeofexploitation":"7","cam_attackeraccessrequired":"20","cam_scorecurrent":"15.75","cam_scorecurrentwidelyknown":"15.75","cam_scorecurrentwidelyknownexploited":"26.25","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":15.75,"vulnote":null}