Info

Disclosure

Jul 17, 2003

Discovery

Unknown

Dates

Exploit

Jul 17, 2003

Solution

Unknown

Description

Server Lock contains a flaw that may allow a malicious user to inject arbitrary DLLs. The issue is triggered when the OpenProcess() call is used and no sanity checks are performed. It is possible that the flaw may allow malicious DLL injection resulting in a loss of integrity.

Classification

Location: Local Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified

Solution

Upgrade to version 2.0.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

WatchGuard Technologies, Inc.

Server Lock

2.0.3

References

CVE ID: 2003-0641 (see also: NVD)
Mail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=105848106631132&w=2
Vendor URL: http://www.watchguard.com/

Credit

Jan K. Rutkowski - jkrutkowskielka.pw.edu.pl -

Direct URL: http://osvdb.org/36218