Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Generic)  >   LANDesk Management Suite Vendors:   LANDesk Software
LANDesk Management Suite Buffer Overflow in 'Aolnsrvr.exe' Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1017912
SecurityTracker URL:
CVE Reference:   CVE-2007-1674   (Links to External Site)
Updated:  Apr 16 2007
Original Entry Date:  Apr 14 2007
Impact:   Execution of arbitrary code via network, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 8.7
Description:   A vulnerability was reported in LANDesk Management Suite. A remote user can execute arbitrary code on the target system.

A remote user can send specially crafted data to UDP port 65535 to trigger a buffer overflow in 'Aolnsrvr.exe' and execute arbitrary code on the target system. The code will run with the privileges of the target service (System level privileges).

The vendor was notified on March 8, 2007.

Aaron Portnoy of the TippingPoint Security Research Team discovered this vulnerability.

The original advisory is available at:

Impact:   A remote user can execute arbitrary code on the target system with System level privileges.
Solution:   The vendor has issued a service pack (8.7 SP2), available at:

The vendor's advisory is available at:

Vendor URL: (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (Any)

Message History:   None.

 Source Message Contents

Subject:  TSRT-07-04: LANDesk Management Suite Alert Service Stack Overflow

TSRT-07-04: LANDesk Management Suite Alert Service Stack Overflow
April 13, 2007

-- CVE ID:

-- Affected Vendor:

-- Affected Products:
Management Suite 8.7

-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability since March 23, 2007 by Digital Vaccine protection
filter ID 5210. For further product information on the TippingPoint IPS: 

-- Vulnerability Details:
This vulnerability allows attackers to execute arbitrary code on
vulnerable installations of LANDesk Management Suite. User interaction
is not required to exploit this vulnerability.

The specific flaw exists in the Alert Service listening on UDP port
65535. The Aolnsrvr.exe process accepts user-supplied data and performs
an inline memory copy into a 268 byte stack-based buffer. Supplying
additional data results in a buffer overflow and SEH overwrite. The
vulnerable memory copy is shown here:

    0041EF49 mov edi, eax  ; edi pointer to stack buffer
    0041EF4B mov eax, ecx
    0041EF4D shr ecx, 2    ; total size of data
    0041EF50 rep movsd
    0041EF52 mov ecx, eax
    0041EF54 mov eax, ebx
    0041EF56 and ecx, 3
    0041EF59 rep movsb

Exploitation allows an attacker to execute arbitrary code under the
context of the SYSTEM user.

-- Vendor Response:
LANDesk has issued an update to correct this vulnerability. More details
can be found at:

-- Disclosure Timeline:
2007.03.08 - Vulnerability reported to vendor
2007.03.23 - Digital Vaccine released to TippingPoint customers
2007.04.13 - Coordinated public release of advisory

-- Credit:
This vulnerability was discovered by Aaron Portnoy, TippingPoint
Security Research Team.


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC