Some vulnerabilities have been reported in Reflection, which can be exploited by malicious, local users to cause a DoS (Denial of Service), disclose potentially sensitive information, or gain escalated privileges and by malicious people to conduct spoofing attacks.

1) The application supports cryptographically insecure MD2 hash signatures by default, which can be exploited to potentially spoof certificates.

2) An error exists when processing certificate fields containing NULL ('\0') characters. This can be exploited to e.g. conduct Man-in-the-Middle (MitM) attacks via specially crafted certificates.

This is related to vulnerability #2 in:
SA36093

3) Multiple vulnerabilities in Reflection X can be exploited by malicious, local users to cause a DoS, disclose potentially sensitive information, or gain escalated privileges.

For more information:
SA28532
SA30627

The vulnerabilities are reported in the following products and versions:
* Reflection for HP version 13.0 and later
* Reflection for UNIX and OpenVMS version 13.0 and later
* Reflection for ReGIS Graphics version 13.0 and later
* Reflection for IBM version 13.0 and later
* Reflection X version 13.0 and later

Solution
Update to version 14.1.

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://support.attachmate.com/techdocs/1708.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area