Novell ZENworks Handheld Management Access Point 'ZfHIPCND.exe' Buffer Overflow Vulnerability

Bugtraq ID:	46024
Class:	Boundary Condition Error
CVE:	CVE-2011-0742
Remote:	Yes
Local:	No
Published:	Jan 26 2011 12:00AM
Updated:	Apr 13 2015 09:01PM
Credit:	Junaid Bohio, Vulnerability Research Team, TELUS Security Labs. and AbdulAziz Hariri through TippingPoint Labs
Vulnerable:	Novell ZENworks Handheld Management 7 SP1 Novell ZENworks Handheld Management 7
Not Vulnerable:

Novell ZENworks Handheld Management Access Point 'ZfHIPCND.exe' Buffer Overflow Vulnerability

Novell ZENworks Handheld Management is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary-checks on user-supplied data.

An attacker can leverage this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will compromise the affected application. Failed exploit attempts will result in a denial-of-service condition.

Novell ZENworks Handheld Management Access Point 'ZfHIPCND.exe' Buffer Overflow Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

Novell ZENworks Handheld Management Access Point 'ZfHIPCND.exe' Buffer Overflow Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Novell ZENworks Handheld Management Access Point 'ZfHIPCND.exe' Buffer Overflow Vulnerability

References:

• Novell ZENworks Handheld Management Homepage (Novell)
  
• Security Vulnerability Buffer Overflow with ZENworks 7 Handheld Management (Novell)
  
• ZDI-11-026 Novell Zenworks Handheld Management ZfHIPCnd.exe Opcode 2 Remote Code (Zero Day Initiative)