======================================================================

                    Secunia Research 25/07/2016

    Reprise License Manager "akey" Buffer Overflow Vulnerability

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Description of Vulnerabilities.......................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9

======================================================================
1) Affected Software

* Reprise License Manager versions 12.0BL2, 12.1BL2, and 12.1BL3.
  Other versions may also be affected.

======================================================================
2) Severity

Rating: Moderately critical
Impact: System compromise
Where:  From local network

======================================================================
3) Description of Vulnerabilities

Secunia Research have discovered a vulnerability in Reprise
License Manager (RLM), which can be exploited by malicious people to
compromise a vulnerable system.

The vulnerability is caused due to a boundary error when handling the
"akey" POST parameter related to /goform/activate_doit, which can be
exploited to cause a stack-based buffer overflow via a specially
crafted HTTP request.

Successful exploitation of the vulnerability may allow execution of
arbitrary code.

======================================================================
4) Solution

No official solution is currently available.

======================================================================
5) Time Table

01/06/2016 - Initial contact with vendor.
01/06/2016 - Vendor responds with service ticket ID.
02/06/2016 - Details transferred.
02/06/2016 - Vendor confirms reception and informs that the issues
             will be fixed in version 12.1.
28/06/2016 - Release of vendor patch.
30/06/2016 - Release of Secunia Advisory SA67000, which includes
             one of the vulnerabilities that is confirmed fixed.
01/07/2016 - Contacted the vendor that vulnerability #2 is still
             unpatched. An requested an ETA for a fixed release.
01/07/2016 - Vendor disagrees on the existence of the vulnerability
             due to the application never to be run with elevated
             privileges by design.
01/07/2016 - Replied to the vendor with detailed analysis of the 
             issue and clarified that as the vulnerability is
             remotely exploitable, it is still exploitable even if
             the application is run without elevated privileges.
03/07/2016 - Vendor requests a screenshot.
12/07/2016 - Provided the vendor with a video file.
12/07/2016 - Vendor replies that the issue is fixed for the next
             release. The vendor notes that the issue is not
             considered a security issue, because RLM should never be
             run as a privileged user.
13/07/2016 - Clarified to the vendor that the issue is indeed seen
             as a security issue and elaborated further on the
             reasons. Requested fix date and set release of
             the Secunia Advisory SA71200 to 22nd July 2016.
19/07/2016 - The vendor informs us that the issue will be fixed in
             the time frame between now and until the end of the
             year.
22/07/2016 - Release of Secunia Advisory SA71200.
25/07/2016 - Public disclosure of Research Advisory.

======================================================================
6) Credits

Discovered by Behzad Najjarpour Jabbari, Secunia Research at Flexera
Software.

======================================================================
7) References

Currently no CVE identifier is assigned.

======================================================================
8) About Secunia (now part of Flexera Software)

In September 2015, Secunia has been acquired by Flexera Software:

https://secunia.com/blog/435/

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

https://secunia.com/products/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private 
individuals, who are interested in or concerned about IT-security.

https://secunia.com/advisories/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the 
security and reliability of software in general:

https://secunia.com/secunia_research/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

https://secunia.com/company/jobs/

======================================================================
9) Verification

Please verify this advisory by visiting the Secunia website:
https://secunia.com/secunia_research/2016-8/

Complete list of vulnerability reports published by Secunia Research:
https://secunia.com/secunia_research/

======================================================================