FrSIRT posted it, which is where I found it.
They link to the details.
In short, there are a couple of reliable overflows in ZenRem32.EXE that will allow server and workstation compromise. This executable is part of the Remote Desktop portion. According to the advisories, this may also be included in servers with Zen for Servers installed on them. The default port for this product is TCP/1761 and UDP/1761, though it can be configured to use a different port.
This is a critical flaw for us in .edu land, where firewalls are scarce on the ground.
They link to the details.
In short, there are a couple of reliable overflows in ZenRem32.EXE that will allow server and workstation compromise. This executable is part of the Remote Desktop portion. According to the advisories, this may also be included in servers with Zen for Servers installed on them. The default port for this product is TCP/1761 and UDP/1761, though it can be configured to use a different port.
This is a critical flaw for us in .edu land, where firewalls are scarce on the ground.
Leave a comment