Secunia Research: Orb Networks Orb Variant Array Parsing Buffer Overflow

======================================================================

                     Secunia Research 25/03/2008

      - Orb Networks Orb Variant Array Parsing Buffer Overflow -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

======================================================================
1) Affected Software

* Orb Networks Orb 2.00.1014.
* Winamp Remote BETA

NOTE: Other versions may also be affected.

======================================================================
2) Severity

Rating: Moderately critical
Impact: System compromise
Where:  Local network

======================================================================
3) Vendor's Description of Software

"Download Orb and start MyCasting all your media to any Internet-
connected mobile phone, PDA or laptop. That's media freedom.".

Product Link:
http://www.orbnetworks.com/

======================================================================
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in Orb, which can be
exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an integer overflow when processing
the number of dimensions in an array of variant types received as
part of an RPC request. This can be exploited to cause a heap-based
buffer overflow by specifying an overly large number of array
dimensions.

Successful exploitation allows execution of arbitrary code.

======================================================================
5) Solution

Update to Orb 2.00.1084.

The vulnerability is also addressed in Winamp Remote BETA 2.00.1024.

======================================================================
6) Time Table

16/01/2008 - Vulnerability discovered.
17/01/2008 - Vendor notified.
17/01/2008 - Vendor response.
25/03/2008 - Public disclosure.

======================================================================
7) Credits

Discovered by Dyon Balding, Secunia Research.

======================================================================
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2008-0070 for the vulnerability.

======================================================================
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://corporate.secunia.com/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.

http://secunia.com/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:

http://corporate.secunia.com/secunia_research/33/

Secunia regularly hires new skilled team members. Check the URL below 
to see currently vacant positions:

http://secunia.com/secunia_vacancies/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
10) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2008-05/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================