CVE-2005-4734 Memory corruption in n/a

What is CVE-2005-4734?

CVE-2005-4734 is a medium-severity memory corruption vulnerability in n/a, published on 19 Mar 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web (aka SecurID Web Agent) 5.2 and 5.3 for IIS allows remote attackers to execute arbitrary code via a long url parameter in the Redirect method.

Which versions are affected by CVE-2005-4734?

It affects 1 product.

Products include Rsa Authentication Agent for Web.

How do I fix CVE-2005-4734?

No fix has been published for CVE-2005-4734 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2005-4734 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2005-4734 exists.

Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2017-14377 Auth bypass in RSA Authentication Agent for Web for Apache Web Server RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 Critical 9.8
• CVE-2018-1232 Memory corruption in RSA Authentication Agent for Web for IIS, RSA Authentication Agent for Web for Apache Web Server High 7.5
• CVE-2018-1233 Cross-site scripting in RSA Authentication Agent for Web for IIS, RSA Authentication Agent for Web for Apache Web Server Medium 6.1
• CVE-2018-1234 Information disclosure in RSA Authentication Agent for Web for IIS Medium 5.5
• CVE-2010-3261 Path traversal in n/a Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3gx3-vcjc-vm83.