|
|
|
|
| |
Credit:
The information has been provided by Francis Provencher, AbdulAziz Hariri and SilentSignal.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-11-089/
|
| |
Vulnerable Systems:
* Novell ZenWorks
Authentication is not required to exploit this vulnerability.
The flaw exists within the novell-tftp.exe component which listens by default on UDP port 69. When handling a request the process blindly copies user supplied data into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the ZenWorks user.
Patch Availability:
Novell has issued an update to correct this vulnerability. More details can be found at:
http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7007896&sliceId=2&docTypeID=DT_TID_1_1&dialogID=205671351&stateId=0%200%20205669596
CVE Information:
CVE-2010-4323
Disclosure Timeline:
2010-08-23 - Vulnerability reported to vendor
2011-02-17 - Coordinated public release of advisory
|
|
|
|
|
