CVE-2008-2468

Related Files

TPTI-08-06.txt

Posted Sep 16, 2008

Authored by Aaron Portnoy | Site tippingpoint.com

A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LANDesk Management Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists within the QIP Server Service (qipsrvr.exe) which listens by default on TCP port 12175. The process makes a vulnerable call to MultiByteToWideChar using values obtained from packet data. A malicious 'heal' request can allow an attacker to control both the pointer to the StringToMap and the StringSize arguments. The destination buffer is either allocated on the stack or heap depending on the specified sizes. In both cases it can be overflown leading to arbitrary code execution under the context of the SYSTEM user.

tags | advisory, remote, overflow, arbitrary, tcp, code execution

advisories | CVE-2008-2468

SHA-256 | ff6889cec64d47b85818ece735464037c8c4a2e41b36d8a8b02923a7d1f1cecd

Download | Favorite | View