Two vulnerabilities have been reported in EMC Documentum ApplicationXtender, which can be exploited by malicious people to compromise a vulnerable system.

1) An input sanitation error exists in the upload functionality of the Admin Agent service (aws_tmxn.exe). This can be exploited to upload arbitrary files to arbitrary locations via directory traversal attacks.

2) An error in the Admin Agent service (aws_tmxn.exe) can be exploited to cause a heap-based buffer overflow via a specially crafted packet sent to TCP port 2606.

Successful exploitation of the vulnerabilities allows execution of arbitrary code.

The vulnerabilities are reported in EMC Documentum ApplicationXtender version 5.40 SP1 and prior.

Solution
A hotfix was made available in August 2008 via EMC AX Support issue CQOTG00074151.
Further details available in Customer Area

Provided and/or discovered by
Stephen Fewer of Harmony Security, reported via ZDI

Original Advisory
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-08-095
http://www.zerodayinitiative.com/advisories/ZDI-08-096

Deep Links
Links available in Customer Area