list@rem0te.com
19/05/05, 00:05
Date
May 18, 2005
Vulnerabilities
Novell ZENworks provides Remote Management capabilities to large networks=
.. In order to manage remote nodes ZENworks implements an authentication p=
rotocol to verify the requestor is authorized for a transaction. This aut=
hentication protocol contains several stack and heap overflows that can b=
e triggered by an unauthenticated remote attacker to obtain control of th=
e system that requires authentication. These overflows are the result of =
unchecked copy values, sign misuse, and integer wraps.
There are several arbitrary heap overflows with no character restrictions=
that are the result of integer wraps. These integer wraps occur because =
words from the network are sign extended and then incremented. The result=
s of these calculations are passed to new(0). Input of -1 to these calcul=
ations will result in small memory allocations and negative length receiv=
es to overflow the allocated memory.
There is an arbitrary stack overflow with no character restrictions in th=
e authentication negotiation for type 1 authentication requests. The stac=
k overflow is a result of an unchecked password length used as the copy l=
ength for the password to a stack variable only 0x1C bytes long.
There are several arbitrary stack overflows with no character restriction=
s in the authentication negotiation for type 2 authentication requests. A=
ll are the result of unchecked lengths being used to copy arbitrary netwo=
rk data to an argument that is a stack variable of the caller. These leng=
ths also contain integer wraps and sign misuse issues.
Impact
Successful exploitation of ZENworks allows attackers unauthorized control=
of related data and privileges on the machine and network. It also provi=
des attackers leverage for further network compromise. Most likely the ZE=
Nworks implementation will be vulnerable in its default configuration.
Affected Products
All versions of Novell ZENworks are vulnerable. If the authentication neg=
otiation is used in other products, they are also likely to be vulnerable=
.. Refer to Novell for specifics.
Advisories:
http://www.rem0te.com/public/images/zen.pdf
http://support.novell.com/cgi-bin/search/searchtid.cgi?/10097644.htm
Credit
These vulnerabilities were discovered and researched by Alex Wheeler.
Contact
security@rem0te.com
May 18, 2005
Vulnerabilities
Novell ZENworks provides Remote Management capabilities to large networks=
.. In order to manage remote nodes ZENworks implements an authentication p=
rotocol to verify the requestor is authorized for a transaction. This aut=
hentication protocol contains several stack and heap overflows that can b=
e triggered by an unauthenticated remote attacker to obtain control of th=
e system that requires authentication. These overflows are the result of =
unchecked copy values, sign misuse, and integer wraps.
There are several arbitrary heap overflows with no character restrictions=
that are the result of integer wraps. These integer wraps occur because =
words from the network are sign extended and then incremented. The result=
s of these calculations are passed to new(0). Input of -1 to these calcul=
ations will result in small memory allocations and negative length receiv=
es to overflow the allocated memory.
There is an arbitrary stack overflow with no character restrictions in th=
e authentication negotiation for type 1 authentication requests. The stac=
k overflow is a result of an unchecked password length used as the copy l=
ength for the password to a stack variable only 0x1C bytes long.
There are several arbitrary stack overflows with no character restriction=
s in the authentication negotiation for type 2 authentication requests. A=
ll are the result of unchecked lengths being used to copy arbitrary netwo=
rk data to an argument that is a stack variable of the caller. These leng=
ths also contain integer wraps and sign misuse issues.
Impact
Successful exploitation of ZENworks allows attackers unauthorized control=
of related data and privileges on the machine and network. It also provi=
des attackers leverage for further network compromise. Most likely the ZE=
Nworks implementation will be vulnerable in its default configuration.
Affected Products
All versions of Novell ZENworks are vulnerable. If the authentication neg=
otiation is used in other products, they are also likely to be vulnerable=
.. Refer to Novell for specifics.
Advisories:
http://www.rem0te.com/public/images/zen.pdf
http://support.novell.com/cgi-bin/search/searchtid.cgi?/10097644.htm
Credit
These vulnerabilities were discovered and researched by Alex Wheeler.
Contact
security@rem0te.com