-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2010.1128
    A number of vulnerabilities have been identified in Novell ZENWorks
                             14 December 2010

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Novell ZENWorks
Publisher:         Zero Day Initiative
Operating System:  Windows
                   Netware
                   Linux variants
Impact/Access:     Administrator Compromise        -- Remote/Unauthenticated
                   Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution:        Patch/Upgrade

Original Bulletin: 
   http://www.zerodayinitiative.com/advisories/ZDI-10-283/
   http://www.zerodayinitiative.com/advisories/ZDI-10-284/
   http://www.zerodayinitiative.com/advisories/ZDI-10-285/

Comment: This bulletin contains three (3) Zero Day Initiative security 
         advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

Novell ZENWorks Remote Management Agent Uninitialized Pointer Remote Code 
Execution Vulnerability
ZDI-10-283: December 13th, 2010
CVSS Score

      10, (AV:N/AC:L/Au:N/C:C/I:C/A:C) 

Affected Vendors

      Novell

Affected Products

      Zenworks

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on 
vulnerable installations of Novell ZENWorks. Authentication is not required to 
exploit this vulnerability.

The specific flaw exists within the ZenRem32.exe process which listens by 
default on TCP and UDP ports 1761. When processing incoming connections with 
specific version fields the process fails to initialize a string buffer 
intended to hold the name of the client. After making allocations based on the 
size of the uninitialized string, ZenRem32 proceeds to convert the buffer 
between wide-char and multi-byte data types. As the pointer is directed at 
uninitialized memory, this can be abused to corrupt the heap. An attacker can 
leverage this to execute remote code under the context of the SYSTEM user.

Vendor Response

Novell states:

Fixed in ZENworks 7 Desktop Management Support Pack 1 Interim Release 4 Hot 
Patch 5:
http://download.novell.com/Download?buildid=r9kcCymJ7Os

Documented in TID 7007320 
http://www.novell.com/support/dynamickc.do?cmd=show&forward=nonthreadedKC&docType=kc&externalId=7007320&sliceId=1

Disclosure Timeline

      2010-06-30 - Vulnerability reported to vendor
      2010-12-13 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:

      sb

- -------------------------------------------------------------------------------

Novell ZENWorks Remote Management Agent DN Name Remote Code Execution 
Vulnerability
ZDI-10-284: December 13th, 2010
CVSS Score

      10, (AV:N/AC:L/Au:N/C:C/I:C/A:C) 

Affected Vendors

      Novell

Affected Products

      Zenworks

TippingPoint IPS Customer Protection
TippingPoint IPS customers are protected against this vulnerability by Digital 
Vaccine protection filter ID 10394,10395. For further product information on 
the TippingPoint IPS:

      http://www.tippingpoint.com 

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on 
vulnerable installations of Novell ZENWorks. Authentication is not required to 
exploit this vulnerability.

The specific flaw exists within the ZenRem32.exe process which listens by 
default on TCP and UDP ports 1761. When processing the Console DN field of 
incoming requests, the process can be made to overflow a stack buffer by 2 
bytes. Due to the location of the destination buffer, an attacker can abuse 
this to overwrite a portion of a return address and execute remote code under 
the context of the SYSTEM user.

Vendor Response

Novell states:

Fixed in ZENworks 7 Desktop Management Support Pack 1 Interim Release 4 Hot 
Patch 5:
http://download.novell.com/Download?buildid=r9kcCymJ7Os

Documented in TID 7007339
http://www.novell.com/support/dynamickc.do?cmd=show&forward=nonthreadedKC&docType=kc&externalId=7007339&sliceId=1

Disclosure Timeline

      2010-06-30 - Vulnerability reported to vendor
      2010-12-13 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:

      sb

- -------------------------------------------------------------------------------

Novell ZENworks Desktop Management Linux TFTPD Remote Code Execution 
Vulnerability
ZDI-10-285: December 13th, 2010
CVSS Score

      9, (AV:N/AC:L/Au:N/C:P/I:P/A:C) 

Affected Vendors

      Novell

Affected Products

      Zenworks

TippingPoint IPS Customer Protection
TippingPoint IPS customers are protected against this vulnerability by Digital 
Vaccine protection filter ID 2132. For further product information on the 
TippingPoint IPS:

      http://www.tippingpoint.com 

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on 
vulnerable installations of Novell Zenworks Desktop Management. Authentication 
is not required to exploit this vulnerability.

The flaw exists within the tftpd server component which listens by default on 
UDP port 69. When handling the filename in a Read Request (0x01) packet type 
the process blindly copies user supplied data into a fixed-length buffer on 
the stack. A remote attacker can exploit this vulnerability to execute 
arbitrary code under the context of the tftpd server process.

Vendor Response

Novell states:

Fixed in ZENworks 7 Desktop Management Support Pack 1 Interim Release 4 Hot 
Patch 5:
http://download.novell.com/Download?buildid=r9kcCymJ7Os

Documented in TID 7007321
http://www.novell.com/support/dynamickc.do?cmd=show&forward=nonthreadedKC&docType=kc&externalId=7007321&sliceId=1

Disclosure Timeline

      2010-07-20 - Vulnerability reported to vendor
      2010-12-13 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:

      Francis Provencher for Protek Researchh Lab's

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFNBuqm/iFOrG6YcBERAoZmAJ0TczHE6jXEOhlodAcG11kJBC5c4ACgxZCl
DaLK7Nxv4F0A5lptBvw028k=
=pKAD
-----END PGP SIGNATURE-----