EMC NetWorker Remote Exec service subcmd buffer overflow

Added: 11/09/2007
CVE: CVE-2007-3618
BID: 25375
OSVDB: 39744

Background

EMC NetWorker is a centralized data backup solution.

Problem

A buffer overflow vulnerability in the Remote Exec service (**nsrexecd.exe**) allows remote attackers to execute arbitrary commands by sending a long, invalid subcmd to a poll or kill request.

Resolution

For fix information see EMC knowledge base article esg83899 which is available from EMC Powerlink.

References

<http://www.zerodayinitiative.com/advisories/ZDI-07-049.html&gt;

Limitations

Exploit works on EMC NetWorker 7.3.2 on Windows 2000, and on Windows Server 2003 with Data Execution Prevention (DEP) enabled.

Platforms

Windows 2000
Windows Server 2003 SP1
Windows Server 2003 SP2 / Windows Server 2003