A buffer overflow vulnerability exists in Novell ZENworks Handheld Management that could be exploited by remote unauthenticated attackers to execute arbitrary code with SYSTEM privileges on a vulnerable server.
The vulnerability is due to a boundary error in the IP Conduit Service, ZfHIPCND.exe. If a crafted packet is sent to the service on port 2400/TCP, it allocates a fixed size heap buffer and copies the client device information into it without validating the string size. This could be exploited by attackers to overflow the buffer and possibly execute arbitrary code with the privileges of the ZfHIPCND.exe service, by default SYSTEM.
Disclosure Timeline:
2010-12-21 Reported to the vendor
2010-12-21 Vendor response
2011-01-25 Vendor released patches and advisory
2011-01-26 Published TSL advisory
