Authentication is not required to exploit this vulnerability.
The flaw exists within the ndiiop.exe component which listens by default on a dynamic TCP port. When handling a GIOP getEnvironmentString request the process blindly copies user supplied argument into an stack buffer while checking the local variable cache. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
Disclosure Timeline:
2010-07-20 - Vulnerability reported to vendor
2011-02-07 - Coordinated public release of advisory
