Gary O'leary-Steele has reported a vulnerability in RSA Authentication Agent for Web for Internet Information Services, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error and can be exploited to cause a heap-based buffer overflow by sending an overly long "chunk" of data via the chunked-encoding mechanism.

Successful exploitation allows execution of arbitrary code.

The vulnerability has been reported in versions 5, 5.2, and 5.3. Other versions may also be affected.

Solution
The vendor has reportedly issued a patch.
Further details available in Customer Area

Provided and/or discovered by
Gary O'leary-Steele, Sec-1.

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area