Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Manage Engine Asset Explorer Agent - Remote DoS

High

Synopsis

Asset Explorer agent listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation), the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory is never free-ed in the program, causing a memory leak. Additionally, the instruction sent to aeagent (ie: NEWSCAN, DELTASCAN, etc) is converted to a unicode string, but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition.

Solution

Contact vendor for latest update information.

Disclosure Timeline

03/16/2021 - Tenable discloses issue
03/16/2021 - Manage Engine confirms they received report, will investigate issue.
04/1/2021 - Tenable follows up on issue to see if it has been confirmed and if patch is expected.
04/21/2021 - Tenable follows up on issue asking for update.
05/2/21 - ManageEngine explains bugs are still being worked on, will update when patches released
5/10/2021 - ManageEngine asks to delay disclosure by two months
5/11/2021 - Tenable offers a two week delay to disclosures due to extenuating circumstances.
5/25/2021 - Tenable follows up on issue
6/1/2021 - ManageEngine replies that issues should be patched by two week extended disclosure dates
6/22/2021 - Tenable requests status update

All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]

Risk Information

CVE ID: CVE-2021-20108
Tenable Advisory ID: TRA-2021-29
Credit:
David Wells
CVSSv2 Base / Temporal Score:
7.8 / 7.8
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products:
Manage Engine Asset Explorer Agent version 1.0.34
Risk Factor:
High

Advisory Timeline

July 16, 2021 - Initial release