[SA20431] TIBCO Hawk "tibhawkhma" Privilege Escalation Vulnerability

---

Want to join the Secunia Security Team?

Secunia offers a position as a security specialist, where your daily
work involves reverse engineering of software and exploit code,
auditing of source code, and analysis of vulnerability reports.

http://secunia.com/secunia_security_specialist/

---

TITLE:
TIBCO Hawk "tibhawkhma" Privilege Escalation Vulnerability

SECUNIA ADVISORY ID:
SA20431

VERIFY ADVISORY:
http://secunia.com/advisories/20431/

CRITICAL:
Less critical

IMPACT:
Privilege escalation

WHERE:
Local system

SOFTWARE:
TIBCO Hawk 4.x
http://secunia.com/product/10339/

DESCRIPTION:
A vulnerability has been reported in TIBCO Hawk, which can be
exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to a boundary error within the
configuration interface of the Hawk Monitoring Agent. This can be
exploited by a local user to execute arbitrary code with escalated
privileges.

Successful exploitation requires that the user is able to modify the
configuration of the TIBCO Hawk HMA (tibhawkhma) executable.

The vulnerability has been reported in TIBCO Hawk versions prior to
4.6.1 and in TIBCO Runtime Agent (TRA) versions prior to 5.4.

SOLUTION:
Update to TIBCO Hawk to version 4.6.1 or later.

PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.

ORIGINAL ADVISORY:
http://www.tibco.com/resources/mk/hawk_security_advisory.txt

OTHER REFERENCES:
US-CERT VU#620516:
http://www.kb.cert.org/vuls/id/620516

---

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.