EMC NetWorker Remote Exec service subcmd buffer overflow

2007-11-09T00:00:00
ID SAINT:91F30B73B1975F5989428DC9C4D4F0E0
Type saint
Reporter SAINT Corporation
Modified 2007-11-09T00:00:00

Description

Added: 11/09/2007
CVE: CVE-2007-3618
BID: 25375
OSVDB: 39744

Background

EMC NetWorker is a centralized data backup solution.

Problem

A buffer overflow vulnerability in the Remote Exec service (**nsrexecd.exe**) allows remote attackers to execute arbitrary commands by sending a long, invalid subcmd to a poll or kill request.

Resolution

For fix information see EMC knowledge base article esg83899 which is available from EMC Powerlink.

References

<http://www.zerodayinitiative.com/advisories/ZDI-07-049.html>

Limitations

Exploit works on EMC NetWorker 7.3.2 on Windows 2000, and on Windows Server 2003 with Data Execution Prevention (DEP) enabled.

Platforms

Windows 2000
Windows Server 2003 SP1
Windows Server 2003 SP2 / Windows Server 2003