You are here

T-548: Novell ZENworks Handheld Management (ZHM) ZfHIPCnd.exe buffer overflow

February 2, 2011 - 7:15am



Novell ZENworks Handheld Management (ZHM) ZfHIPCnd.exe buffer overflow.


Novell Zenworks Handheld Management 7


Novell ZENworks Handheld Management (ZHM) is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the ZfHIPCnd.exe Access Point process. By sending a specially-crafted request to TCP port 2400, a remote attacker could overflow a buffer and execute arbitrary code on the system with SYSTEM privileges or cause the application to crash.

reference LINKS:

TippingPoint: Zero Day Initiative
Redhat - CVE-2010-0742
Novell ZENworks - CVE-2010-0742




This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks Handheld Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Access Point process (ZfHIPCnd.exe) which listens by default on TCP port 2400. The problem occurs due to the application copying arbitrary sized data from a packet into a statically sized buffer. Due to the application not accommodating for the variable sized data during initialization of this buffer a buffer overflow will occur. This can lead to code execution under the context of the application.


Currently there are no patches for this vulnerability.