TIBCO SmartSockets Multiple Pointer Offset Remote Code Execution Vulnerabilities

TIBCO SmartSockets Multiple Pointer Offset Remote Code Execution Vulnerabilities

TIBCO SmartSockets is prone to multiple remote code-execution vulnerabilities because user-supplied input is used to change valid pointer values.

Attackers can leverage these issues to execute arbitrary code with the privileges of the application. If the application is installed as a system service on Windows platforms, then the code will execute with SYSTEM-level privileges. Successful exploits will completely compromise affected computers. Failed attacks will likely cause denial-of-service conditions.

SmartSockets 6.8.0 is vulnerable; other versions may also be affected.

The following components are affected:

TIBCO RTworks Server (rtserver)
TIBCO RTworks Data Archive Process (rtarchive)
TIBCO RTworks Data Playback Process (rtplayback)
TIBCO RTworks Data Acquisition Process (rtdaq)
TIBCO RTworks Human Computer Interface (rthci)
TIBCO RTworks Inference Engine (rtie)
TIBCO RTworks libraries (rtipc, rtutil)