Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Manage Engine Heap Overflow POST payload

High

Synopsis

Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In AEAgent.cpp, the agent responding back over HTTP is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is converted to Unicode using vswprintf. This is written to a buffer only 0x2000 bytes big. If POST payload is larger, then heap overflow will occur.

Solution

Contact vendor for update information.

Disclosure Timeline

03/26/2021 - Tenable discloses issue
03/26/2021 - ManageEngine acknowledges and will look into issue
04/08/2021 - Tenable follows up asking if ME is able to confirm the issue
04/12/2021 - ManageEngine responds that the bugs are being worked on
05/07/2021 - Manage Engine says issue is still being worked on, will update when patch releases
5/10/2021 - ManageEngine asks to delay disclosure by two months
5/11/2021 - Tenable offers a two week delay to disclosures due to extenuating circumstances.
5/25/2021 - Tenable follows up on issue
6/1/2021 - ManageEngine replies that issues should be patched by two week extended disclosure dates
6/22/2021 - Tenable requests status update

All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]

Risk Information

CVE ID: CVE-2021-20109
Tenable Advisory ID: TRA-2021-30
Credit:
David Wells
CVSSv2 Base / Temporal Score:
7.8 / 7.8
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:C/A:N
Affected Products:
Manage Engine Asset Explorer Agent version 1.0.34
Risk Factor:
High

Advisory Timeline

July 16, 2021 - Initial release.