Akamai Technologies Security Advisory 2009-0001

Akamai ID: 2009-0001
Date: 2009/23/20
Product Name: Download Manager
Affected Versions: < 2.2.4.8
Fixed Version: 2.2.4.8
CVE IDs: {TBD}
CVSS Base Score: (AV:R/AC:H/Au:NR/C:C/I:C/A:C/B:N) 8.0

Product Description
Akamai Download Manager is a client software application that helps users download content easily, quickly, and reliably. It is available as an ActiveX component or Java applet and provides users the ability to pause, resume downloading at a later time, and automatically recover from dropped connections or system crashes.

Vulnerability Description
Akamai has become aware of a security vulnerability within the Akamai Download Manager up to and including version 2.2.3.7 of the ActiveX control. For successful exploitation, this vulnerability requires a user to be convinced to visit a malicious URL put into place by an attacker. This may then lead to an unauthorized download and automatic execution of arbitrary code run within the context of the victim user.

This vulnerability exist only in the Download Manager client software and does not affect Akamai's services in any way.

Patch Instructions
For ActiveX versions:
Affected users can upgrade to the latest version of Akamai Download Manager by visiting the following web page:

http://dlm.tools.akamai.com/tools/upgrade.html

Visiting that page or any other Download Manager enabled page will prompt the user to install the latest version of the software automatically. Akamai has successfully coordinated with each of our enterprise customers to ensure that all are distributing the patched version.

To verify the correct version is installed:

  • In Internet Explorer, choose "Internet Options..." from the "Tools" menu.
  • Under the "General" tab, select "Settings..." from the "Temporary Internet files" section.
  • Select "View Objects..." from the "Temporary Internet files folder" section.
  • Find the item for "DownloadManager Control" and verify that the version is "2,2,4,8" or higher.
    If you wish to uninstall Download Manager, complete this last step:
  • Find the item for "DownloadManager Control", right-click and select "Remove".
  • When prompted to confirm, choose "Yes".
For Java versions: The java version is not persistently installed. No action is required by the user.

Credit
This vulnerability was independently discovered and brought to Akamai's attention by iDefense (http://labs.idefense.com).

Additional Information
http://www.akamai.com/html/support/security.html

About Akamai:
Akamai® is the leading global service provider for accelerating content and business processes online. Thousands of organizations have formed trusted relationships with Akamai, improving their revenue and reducing costs by maximizing the performance of their online businesses. Leveraging the Akamai EdgePlatform, these organizations gain business advantage today, and have the foundation for the emerging Web solutions of tomorrow. Akamai is "The Trusted Choice for Online Business." For more information, visit www.akamai.com.

Akamai Technologies Security Advisory 2008-0002

Akamai ID: 2008-0002
Date: 2008/04/20
Product Name: Download Manager
Affected Versions: < 2.2.3.6
Fixed Version: 2.2.3.7
CVE IDs: CVE-2008-1770
CVSS Base Score: (AV:R/AC:H/Au:NR/C:C/I:C/A:C/B:N) 8.0

Product Description
Akamai Download Manager is a client software application that helps users download content easily, quickly, and reliably. It is available as an ActiveX component or Java applet and provides users the ability to pause, resume downloading at a later time, and automatically recover from dropped connections or system crashes.

Vulnerability Description
Akamai has become aware of a security vulnerability within the Akamai Download Manager up to and including version 2.2.3.5 of the ActiveX control. For successful exploitation, this vulnerability requires a user to be convinced to visit a malicious URL put into place by an attacker. This may then lead to an unauthorized download and automatic execution of arbitrary code run within the context of the victim user.

This vulnerability exist only in the Download Manager client software and does not affect Akamai's services in any way.

Patch Instructions
Affected users can upgrade to the latest version of Akamai Download Manager by visiting the following web page:

http://dlm.tools.akamai.com/tools/upgrade.html

Visiting that page or any other Download Manager enabled page will prompt the user to install the latest version of the software automatically. Akamai has successfully coordinated with each of our enterprise customers to ensure that all are distributing the patched version.

To verify the correct version is installed:

  • In Internet Explorer, choose "Internet Options..." from the "Tools" menu.
  • Under the "General" tab, select "Settings..." from the "Temporary Internet files" section.
  • Select "View Objects..." from the "Temporary Internet files folder" section.
  • Find the item for "DownloadManager Control" and verify that the version is "2,2,3,5" or higher.
    If you wish to uninstall Download Manager, complete this last step:
  • Find the item for "DownloadManager Control", right-click and select "Remove".
  • When prompted to confirm, choose "Yes".

Credit
CVE-2008-1770 was independently discovered and brought to Akamai's attention by FortiNet (http://fortinet.com).
Fortinet (http://www.fortinet.com/)

Additional Information
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1770

Akamai Technologies Security Advisory 2007-0001

Akamai ID: 2007-0001
Date: 2007/04/11
Product Name: Download Manager
Affected Versions: < 2.2.1.0
Fixed Version: 2.2.1.0
CVE IDs: CVE-2007-1891 CVE-2007-1892
CVSS Base Score: (AV:R/AC:H/Au:NR/C:C/I:C/A:C/B:N) 8.0

Product Description
Akamai Download Manager is a client software application that helps users download content easily, quickly, and reliably. It is available as an ActiveX component or Java applet and provides users the ability to pause, resume downloading at a later time, and automatically recover from dropped connections or system crashes.

Vulnerability Description
Two security vulnerabilities have been discovered in the ActiveX version of Akamai Download Manager. For successful exploitation, both vulnerabilities require the user to visit a malicious URL, triggering a stack-based buffer overflow that allows the attacker to execute arbitrary code within the context of the victim.

Vulnerability CVE-2007-1891 affects versions newer than 2.0.4.4 and older than 2.2.1.0. Vulnerability CVE-2007-1892 affects all versions prior to 2.2.1.0. Both are remediated by installing version 2.2.1.0 and upgrading to this version is recommended.

The Java version of Akamai Download Manager is not affected by either of these vulnerabilities.

These vulnerabilities exist only in the Download Manager client software and do not affect Akamai's services in any way.

Patch Instructions
Affected users can upgrade to the latest version of Akamai Download Manager by visiting the following web page:

http://dlm.tools.akamai.com/tools/upgrade.html

Visiting that page or any other Download Manager enabled page will prompt the user to install the latest version of the software automatically. Akamai has successfully coordinated with each of our enterprise customers to ensure that all are distributing the patched version.

To verify the correct version is installed:

  • In Internet Explorer, choose "Internet Options..." from the "Tools" menu.
  • Under the "General" tab, select "Settings..." from the "Temporary Internet files" section.
  • Select "View Objects..." from the "Temporary Internet files folder" section.
  • Find the item for "DownloadManager Control" and verify that the version is "2,2,1,0" or higher.
    If you wish to uninstall Download Manager, complete this last step:
  • Find the item for "DownloadManager Control", right-click and select "Remove".
  • When prompted to confirm, choose "Yes".

Credit
CVE-2007-1891 was independently discovered and brought to Akamai's attention by both:
Fortinet (http://www.fortinet.com/)
iDefense (http://labs.idefense.com/)

CVE-2007-1892 was discovered by Akamai.

Additional Information
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1891
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1892