Novell ZENworks Handheld Management Multiple Remote Code Execution Vulnerabilities

Bugtraq ID:	50303
Class:	Boundary Condition Error
CVE:	CVE-2011-2655 CVE-2011-2656
Remote:	Yes
Local:	No
Published:	Oct 20 2011 12:00AM
Updated:	Dec 13 2011 07:18AM
Credit:	V-kndy58lcwg, V-ce0xct1eor of iDefense and Luigi Auriemma
Vulnerable:	Novell ZENworks Handheld Management 7 SP1 Novell ZENworks Handheld Management 7
Not Vulnerable:

Novell ZENworks Handheld Management Multiple Remote Code Execution Vulnerabilities

Novell ZENworks Handheld Management is prone to multiple remote code-execution vulnerabilities.

An attacker can leverage this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will compromise the affected application. Failed exploit attempts will result in a denial-of-service condition.

Novell ZENworks Handheld Management Multiple Remote Code Execution Vulnerabilities

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

Novell ZENworks Handheld Management Multiple Remote Code Execution Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

Novell ZENworks Handheld Management Multiple Remote Code Execution Vulnerabilities

References:

• Novell ZENworks Handheld Management Homepage (Novell)
  
• Novell ZenWorks Handheld Management ReadStatusRecordData Integer Overflow Vulner (iDefense)
  
• Novell ZenWorks Handheld Management Unicode String Parsing Integer Overflow Vuln (iDefense)
  
• ZHM 7 Remote Code Execution Vulnerability (Novell)