Security researchers have identified multiple unpatched vulnerabilities (http://www.securityfocus.com/bid/26092/exploit) in a widely-used content distribution package.

Tibco's SmartPGM FX multicasting software is prone to multiple remote vulnerabilities, including four stack-based buffer-overflow flaws, a format-string issue, and a potential denial of service bug.

Hackers might exploit these issues to execute arbitrary code or cause denial-of-service attacks, warns UK consultancy Information Risk Management (IRM).

IRM, which has a track record of discovering bugs in the software, is withholding details of the flaws pending the availability of patches from Tibco.

To date, there's no evidence that the bugs have being used in anger by hackers. Nonetheless, the discovery of the bugs illustrates a wider range of software packages than is commonly imagined can be subject to so-called zero-day vulnerabilities. ®

Related stories

Researcher releases unofficial IE fix for URI bug (16 October 2007)
http://www.theregister.co.uk/2007/10/16/unofficial_uri_windows_fix/
Tibco backs Ajax with message bus (3 August 2007)
http://www.theregister.co.uk/2007/08/03/tibco_pagebus_ajax/
The rise of zero-day patches (2 March 2007)
http://www.theregister.co.uk/2007/03/02/zero-day_patches_interviews/
Tibco takes pop at SOA complexity (7 December 2006)
http://www.theregister.co.uk/2006/12/07/tibco_soa_activematrix/
Unofficial zero-day patches gain corporate support (4 April 2006)
http://www.theregister.co.uk/2006/04/04/0-day_patch_survey/