----------------------------------------------------------------------

BETA test the new Secunia Personal Software Inspector!

The Secunia PSI detects installed software on your computer and
categorises it as either Insecure, End-of-Life, or Up-To-Date.
Effectively enabling you to focus your attention on software
installations where more secure versions are available from the
vendors.

Download the free PSI BETA from the Secunia website:
https://psi.secunia.com/

----------------------------------------------------------------------

TITLE:
Motorola Timbuktu Pro Directory Traversal and Buffer Overflows

SECUNIA ADVISORY ID:
SA26588

VERIFY ADVISORY:
http://secunia.com/advisories/26588/

CRITICAL:
Highly critical

IMPACT:
DoS, System access

WHERE:
>From remote

SOFTWARE:
Timbuktu Pro 8.x for Windows
http://secunia.com/product/9996/

DESCRIPTION:
Some vulnerabilities have been reported in Timbuktu Pro, which can be
exploited by malicious users and malicious people to compromise a
vulnerable system.

1) A directory traversal within the handling of "Send" requests can
be exploited to create and delete arbitrary files with SYSTEM
privileges by sending specially crafted requests containing directory
traversal sequences ("../").

Successful exploitation requires "Send" privileges (reportedly
enabled by default for "Guest" users in the evaluation version).

2) Errors exists within the processing of certain unspecified
application protocol requests. This can be exploited to cause a
heap-based buffer overflow by sending specially crafted requests to a
vulnerable server.

3) An error exists within the processing of log requests. This can be
exploited to cause a heap corruption by sending a specially crafted
log request containing an overly long log user name to a vulnerable
server.

Successful exploitation of vulnerabilities #2 and #3 may allow the
execution of arbitrary code, but requires that the attacker is able
to connect to the Timbuktu service (default port 407 TCP/UDP).

4) A vulnerability exists within the "Scanner" feature when
processing "HELLO" responses. This can be exploited to cause a buffer
overflow by running a malicious socket server in the local network and
tricking a user into connecting to it (default port 407/TCP).

The vulnerabilities are reported in version 8.6.3.1367 of Timbuktu
Pro for Windows. Other versions prior to 8.6.5 may also be affected.

SOLUTION:
Update to version 8.6.5.

PROVIDED AND/OR DISCOVERED BY:
Titon of BastardLabs, reported via iDefense Labs

ORIGINAL ADVISORY:
Motorola:
ftp://ftp-xo.netopia.com/evaluation/docs/timbuktu/win/865/relnotes/TB2Win865Evalrn.pdf

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=589
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=590

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------