RSA SecurID Web Agent for IIS redirect buffer overflow

Added: 11/30/2005
CVE: CVE-2005-4734
BID: 26424
OSVDB: 20151

Background

RSA SecurID Web Agent for IIS provides access control for IIS web servers using one-time authentication tokens.

Problem

A buffer overflow in **IISWebAgentIF.dll** could allow a remote attacker to execute arbitrary commands using a long, specially crafted url parameter in a Redirect request.

Resolution

Fixes are available from RSA SecurCare Online.

References

<http://secunia.com/advisories/17281/&gt;

Limitations

Web Agent for IIS must be configured correctly in order for this exploit to work.

Platforms

Windows 2000