39744

26517

3043

20070820 ZDI-07-049: EMC Legato Networker Remote Exec Service Stack Overflow Vulnerabilities

25375

1018590

ADV-2007-2931

http://www.zerodayinitiative.com/advisories/ZDI-07-049.html

networker-nsrexecd-bo(36123)

The EMC Legato Networker application running on the remote host is affected by a stack overflow condition in the Networker Remote Exec Service (nsrexecd.exe), specifically within the sprintf() function, when handling poll or kill requests. An unauthenticated, remote attacker can exploit this, via a crafted request using a long invalid subcmd, to execute arbitrary code.

The remote host is running EMC Legato Networker, an enterprise application that enables centralized file management, backup and more.  This version of Legato is vulnerable to a flaw in the 'nsrexecd.exe' application.  An attacker exploiting this flaw would only require the ability to connect to the nsrexecd.exe listening port (111/TCP).  Successful exploitation would result in the execution of arbitrary code.

ID	Name	Product	Family	Severity
94163	EMC Legato Networker Remote Exec Service Stack Overflow RCE	Nessus	Gain a shell remotely	critical
4182	EMC Legato Networker 'nsrexecd.exe' Overflow	Nessus Network Monitor	Generic	medium

CVE-2007-3618

high

Tenable Plugins

critical

medium