Advisory Details

April 6th, 2009

Novell Client/NetIdentity Agent Remote Arbitrary Pointer Dereference Code Execution Vulnerability

ZDI-09-016
ZDI-CAN-397

CVE ID CVE-2009-1350
CVSS SCORE
AFFECTED VENDORS Novell
AFFECTED PRODUCTS Netware
VULNERABILITY DETAILS

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Netware. A valid IPC$ connection must be established in order to exploit this vulnerability.

The specific flaw exists within xtagent.exe during the handling of RPC messages over the XTIERRPCPIPE named pipe. Insufficient sanity checking allows remote attackers to dereference an arbitrary pointer which can be leveraged to execute code under the context of the system user.

VENDOR RESPONSE Novell has issued an update to correct this vulnerability. More details can be found at:
http://download.novell.com/Download?buildid=6ERQGPjRZ8o~
DISCLOSURE TIMELINE
  • 2008-10-15 - Vulnerability reported to vendor
  • 2009-04-06 - Coordinated public release of advisory
CREDIT Ruben Santamarta
BACK TO ADVISORIES