Authentication is not required to exploit this vulnerability.
The flaw exists within the ndiiop.exe component which listens by default on a dynamic TCP port. When handling a GIOP client Request packet type the process can be made to mis-allocate a buffer size due to a signed-ness bug. Later, the process blindly copies user supplied data into this under allocated heap buffer. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
Disclosure Timeline:
2010-07-20 - Vulnerability reported to vendor
2011-02-07 - Coordinated public release of advisory
