Ajit Gaddam on Security & Technology

The TIBCO Rendezvous RVD daemon is vulnerable to a memory leak, which when remotely triggered, prevents any further RV communication until the daemon is manually restarted.

Vulnerability Type / Importance: Remote DoS / High
Workaround: There are no known workarounds for this vulnerability

The RV daemon (RVD) within TIBCO’s Rendezvous messaging product is responsible for the communication of messages between RV-enabled applications. The vulnerability exists as the result of an error in the code that parses information within one of the headers in a TIBCO proprietary network protocol packet.
Technical Details:
Within a Rendezvous “wire format” TCP packet, the first four bytes represent the number of bytes of data to expect within the packet, for example:
“0000007c” //total length of data in packet
“9955eeaa” // “magic” number
“06″ // number of following bytes including null
“6d7479706500″ //the text “mtype”
…etc

In the above example the number of data bytes in the packet is “0×7c”, or 124 bytes. If this value is set to zero in a packet sent to the RVD daemon then it stops responding to all subsequent communication. This appears to result from a memory leak, which continues to attempt to allocate memory. Eventually, operating system alert messages start to appear, warning that the virtual memory in the underlying operating system is running low.

Read more »

If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!

IT Security or Information Security has steadily grown from being an obscured field of work in some government or military or financial institutions to become a mainstream activity practiced by many professionals including myself.

The growth of Internet and the challenges that come with securing the ever growing interconnected digital world along with the anonymity the WWW provides, has been thrown some unique challenges to the modern IT Security professional. We have also seen an explosion of various laws such as Sarbanes Oxley (SOX), the Health Insurance Portability& Accountability Act (HIPPA), the Gramm-Leach-Bliley Act(GLBA), the Payment Card Industry Data Security Standards (PCI) have only served to raise the profile and a huge demand for skilled and experienced Information Security Professionals around the planet.

The demand for an IT Security Professional is not going to die down any time soon but instead keep growing because of the constantly changing and mutating threat landscape in the form of data migration online, ubiquitous connectivity and the global interconnected world we live in.

With this the book IT Security Interviews Exposed by Chris Butler and Wiley publishers let you into the world of IT Security Interviews .. all 218 pages of insight.

IT Security Interviews Exposed Book Description

* Technology professionals seeking higher-paying security jobs need to know security fundamentals to land the job-and this book will help

Read more »