Advisory Details

January 26th, 2011

Novell Zenworks Handheld Management ZfHIPCnd.exe Opcode 2 Remote Code Execution Vulnerability

ZDI-11-026
ZDI-CAN-1071

CVE ID
CVSS SCORE 10.0, AV:N/AC:L/Au:N/C:C/I:C/A:C
AFFECTED VENDORS Novell
AFFECTED PRODUCTS Zenworks
TREND MICRO CUSTOMER PROTECTION Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['10792']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks Handheld Management. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the Access Point process (ZfHIPCnd.exe) which listens by default on TCP port 2400. The problem occurs due to the application copying arbitrary sized data from a packet into a statically sized buffer. Due to the application not accommodating for the variable sized data during initialization of this buffer a buffer overflow will occur. This can lead to code execution under the context of the application.

ADDITIONAL DETAILS

TID 7007663:
http://www.novell.com/support/dynamickc.do?cmd=show&forward=nonthreadedKC&docType=kc&externalId=7007663&sliceId=1

Patch:
http://download.novell.com/Download?buildid=x_x4cdA5yT8~


DISCLOSURE TIMELINE
  • 2011-01-21 - Vulnerability reported to vendor
  • 2011-01-26 - Coordinated public release of advisory
CREDIT AbdulAziz Hariri
BACK TO ADVISORIES