Novell ZENworks Desktop Management 'ZenRem32.exe' Buffer Overflow Vulnerability

Bugtraq ID:	45375
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 13 2010 12:00AM
Updated:	Dec 13 2010 12:00AM
Credit:	sb
Vulnerable:	Novell Desktop Management 7 SP1
Not Vulnerable:

Novell ZENworks Desktop Management 'ZenRem32.exe' Buffer Overflow Vulnerability

Novell ZENworks Desktop Management is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary-checks on user-supplied data.

An attacker can leverage this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will compromise the affected application. Failed exploit attempts will result in a denial-of-service condition.

Novell ZENworks 7 Desktop Management 7 SP1 is vulnerable.

Novell ZENworks Desktop Management 'ZenRem32.exe' Buffer Overflow Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

Novell ZENworks Desktop Management 'ZenRem32.exe' Buffer Overflow Vulnerability

Solution:
The vendor has released an update. Please see the vendor advisory for more information.

Novell ZENworks Desktop Management 'ZenRem32.exe' Buffer Overflow Vulnerability

References:

• Novell ZENworks Handheld Management Homepage (Novell)
  
• ZDI-10-284: Novell ZENWorks Remote Management Agent DN Name Remote Code Executio (Novell)
  
• Security Vulnerability Stack Overflow with ZDM7 Remote Management (Novell)