CVE-2014-5501

Desbordamiento de buffer basado en pila en el servicio de diagnóstica en los dispositivos Sophos Cyberoam with CyberoamOS anterior a 10.6.1 GA permite a atacantes remotos ejecutar código arbitrario a través de una página web manipulada o un fichero manipulado.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sophos Cyberoam. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the diagnose service. The issue lies in the failure to validate the size of the input buffer before copying it into a fixed-size buffer on the stack. An attacker can leverage this vulnerability to execute code under the context of the web server.