TippingPoint Zero Day Initiative
 

Novell Client/NetIdentity Agent Remote Arbitrary Pointer Dereference Code Execution Vulnerability

ZDI-09-016: April 6th, 2009

CVE ID

Affected Vendors

Affected Products

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Netware. A valid IPC$ connection must be established in order to exploit this vulnerability.

The specific flaw exists within xtagent.exe during the handling of RPC messages over the XTIERRPCPIPE named pipe. Insufficient sanity checking allows remote attackers to dereference an arbitrary pointer which can be leveraged to execute code under the context of the system user.

Vendor Response

Novell has issued an update to correct this vulnerability. More details can be found at:

Disclosure Timeline

    2008-10-15 - Vulnerability reported to vendor
    2009-04-06 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:
    Ruben Santamarta