Novell ZENworks Configuration Management PreBoot Service Opcode 0x6c Stack Buffer Overflow Vulnerability
03.14.12
BACKGROUND

ZENworks Configuration Management is an endpoint management solution. It is used to inventory assets (computers), deploy software and patches, and administer client computers from a centralized management console. The software suite consists of numerous system services, one of which is the Preboot Service. This is used to perform imaging operations on client disks before boot time.
DESCRIPTION

Remote exploitation of a stack based buffer overflow vulnerability in Novell Inc.'s ZENworks Configuration Management could allow an attacker to execute arbitrary code with the privileges of the affected service.

The vulnerability occurs when processing incoming requests to the Preboot Service. The request contains binary opcodes used to specify different functionality, and ascii/binary arguments to these commands. Using the opcode 0x6c, it is possible to trigger a strcpy() like function that fails to verify the length of data from the request buffer. This data is copied into a fixed size stack buffer, leading to an exploitable buffer overflow.
ANALYSIS

Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the affected service. The service runs under a special create created by the installer, which is a member of the Administrators group. In order to exploit this vulnerability, an attacker needs the ability to connect to the target over ports 3037. No authentication is necessary. Exploitation is relatively simple, as the vulnerability is a stack based buffer overflow. It is possible to overwrite various pointers located on the stack, and to corrupt the saved instruction pointer.
DETECTION

iDefense has confirmed the existence of this vulnerability in ZENworks Configuration Management version 11.0.0.1992 on the Windows platform.
WORKAROUND

If remote imaging is not being used, then the Preboot Service can be disabled with the following command:

net stop "Novell ZENworks Preboot Service"

This will prevent exploitation of the vulnerability.
VENDOR RESPONSE

Novell has released patches and workarounds to address this vulnerability. For more information, consult their advisory at the following URL.

http://www.novell.com/support/search.do?cmd=displayKC&docType;=kc&externalId;=InfoDocument-patchbuilder-readme5127930&sliceId;=&docTypeID;=DT_SUSESDB_PSDB_1_1&dialogID;=1000895&stateId;=0%200%201004847
CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2011-3175 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.
DISCLOSURE TIMELINE

08/10/2011 Initial Vendor Notification
08/11/2011 Initial Vendor Reply
03/14/2012 Coordinated Public Disclosure
CREDIT

This vulnerability was reported to iDefense by Luigi Auriemma.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

LEGAL NOTICES

Copyright © 2012 Verisign, Inc.

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customer service for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.