Drivers Safend
EHKey lab Yi Ruan NetUSB Driver macho VNG DELL INC Sarin Eltima software ROMEX SOFTWARE%MS% Safend 2012 AX64 Distec GmbH (Data Display Group) Sombrero Audiocodes Teledyne DALSA 百度极速空间 Surpass Cloud CA ARCserve VNG Direct Team DAYU CF IntelliDriver Hitachi Systems Services iSCSI Boot Centerm QILING Tnctr Sanal Hasp MkEmu ETAS GmbH. Mobile money, reinvented. Deposit, withdraw, pay bills for free. Send for only 1%.
Driver Safenet
Quality documentation servicesand solutions to individualsand firms from all around the globe.
Welcome to Uniused Documents for genuine registered and unregistered documents. We produce real and fake passport, drivers license, stamps, visa id cards, school diplomas,NEBOSH, TOEFL, IELTS Certificates, british novelty documents, counterfeit, bogus, Italian, Malaysian, Australian, identity card, identification, driver’s license, license, residence permit, SSN for different countires like: like: Mexico, Israel, USA, Italy,Australia, Belgium,Brazil, Canada, Finland, France, Germany, Netherlands,Spain, United Kingdom, South Africa. We process only high quality universal documents Whatsapp +44 759 445 3610 Email: [email protected]
We are an independent group of IT experts and database technicians. We are specialized in the production of both real and fake passport, SSN, Drivers license, I.D cards, Birth certificates, diplomas and many other documents. All the documents we produce both real and fake posses most if not all of the security features found on state issued documents.
We have been producing passport, license, SSN, I.D cards, Birth certificates, diplomas and other documents for over 160 countries.(North America, South America, Europe, Australia, Asia and Africa) We Produce Both Real Database registered passport, license, SSN, I.D cards, Birth certificates, diplomas which are legally used. contact us atfor more information’s
Drivers Safety Program
WONDERING WHERE TO GET A ID CARD, DRIVER'S LICENSE OR PASSPORT!
High Quality Printers
High quality printers are specifically designed and engineered to print fast, efficiently and reliably
Affordable Prices
We are always able offer our customers the widest range of services at the best prices
Friendly Customer Support
We employ a staff of fully trained, friendly and professional agents that are available 24/7
Fast and Discreet Shipping
We do professional packaging and shipping on all the documents we produce
45 Days Money Back
To guarantee that we deliver on our promises, we provide a 45-days money back refund
Advanced Technology
We are upto date on the most advanced and cutting edge technology in the travel document Industry
Drivers Safety Course Online
Drivers Safety Course For Insurance Discount
Whether it be an individual’s personal or professional life, are either directly or indirectly involved or related to acquiring a judiciary or legally certified document. Whether it be;
- Acquiring a new passport or second one
- Processing and registering a work permit
- Obtaining a legally certified Identity Card
- Getting a new driving license
- Acquiring a new citizenship certificate or dual nationality
AnywhereUSB/5 1.80.00 Drivers Integer Overflow
Risk: low.
This advisory can be found here:
http://www.safend.com/advisories/dig...ntoverflow.txt
I. BACKGROUND
AnywhereUSB/5 provides five USB ports, which deliver the same Plug and Play
user experience as onboard USB ports.
Software drivers are loaded onto a host PC or server, enabling remote devices
to communicate with the host, without changing existing application software.
Peripheral devices can be centrally managed and monitored from a remote
server or PC via an IP address.
http://www.digi.com/products/usb/anywhereusb.jsp
II. DESCRIPTION
This low-risk vulnerability in AnywhereUSB/5 1.80.00 allows an attacker to
forge an AnywhereUSB server, so that if a client connects to it, it can be
hit with a denial of service attack.
This integer overflow in version 1.80.00 of AnywhereUSB/5 drivers package
distributed for Windows NT 4.0/2000/XP and 2003. could allow attackers to
Bugcheck (BSOD) currently connected clients on demand, or any new client upon
connection.
The problem exists within the parsing of USB string descriptors.
A malformed string descriptor that in its header specifies a size of 1 byte,
will cause a memory copy loop to go behind allocated memory range.
This will result in a Bugcheck (BSOD) within the client computer driver.
III. ANALYSIS
Successful exploitation allows an attacker to crash the client computer and
cause a Bugcheck (BSOD) on demand.
Exploitation is possible in two ways: by sending a specially crafted string
descriptor to the client or by attaching a maliciously crafted USB device to
the hub.
IV. DETECTION
Safend has confirmed that AnywhereUSB/5 drivers version 1.80.00 is vulnerable.
It is suspected that earlier versions of AnywhereUSB/5 may also vulnerable.
V. WORKAROUND
Avoid plugging unknown USB devices into an AnywhereUSB/5 hub.
Apply strict firewalls rules, to prevent clients from connecting to a
malicious AnywhereUSB/5 server, which could in turn send the malformed string
descriptor to the client via TCP/IP.
VI. VENDOR RESPONSE
SecuriTeam was asked to assist the researchers with contacting Digi
International.
Reported to vendor: 24th of July, 2006.
Vendor response: 25th of July, 2006.
Vendor's official response:
'The AnywhereUSB product is used with commercial USB peripheral devices on
dedicated point to point IP connections, almost always on non-public local
area networks. The likelihood of any such USB device producing a USB
descriptor corrupted in precisely this way is extremely unlikely. This error
will be corrected in a future driver release.'
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2006-4459 to this issue.
VIII. CREDIT
This vulnerability was discovered by Itzik Kotler, Safend.
IX. About SecuriTeam's Assisted Disclosure
Many researchers do not have the time, energy or inclination to deal with
reporting a vulnerability to vendors.
SecuriTeam is here to help. If you want us to handle the logistics of
contacting and following up with the vendor, making sure the problem is
fixed, contact: STAD@SecuriTeam.com.
Our end goal is Full Disclosure, preferably in coordination with the vendor,
without exposing the researcher to unnecessary risk. We do not believe in
hiding or selling vulnerabilities. Never had, never will.
All credit will be properly attributed. If asked we can act as proxies,
keeping your privacy and anonymity.
X. LEGAL NOTICES
Disclaimer: The information in the advisory is believed to be accurate at the
time of publishing based on currently available information. Use of the
information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the author
nor the publisher accepts any liability for any direct, indirect, or
consequential loss or damage arising from use of, or reliance on, this
information.
---
Safend is a leading provider of innovative endpoint security solutions that
protect against corporate data leakage and penetration via physical and
wireless ports. For more information, visit http://www.safend.com/.