CVE-2005-1543

published 2005-05-25

CVE-2005-1543: Multiple stack-based and heap-based buffer overflows in Remote Management authentication (zenrem32.exe) on Novell ZENworks 6.5 Desktop and Server Management…

Priority P2 70 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Multiple stack-based and heap-based buffer overflows in Remote Management authentication (zenrem32.exe) on Novell ZENworks 6.5 Desktop and Server Management, ZENworks for Desktops 4.x, ZENworks for Servers 3.x, and Remote Management allows remote attackers to execute arbitrary code via (1) unspecified vectors, (2) type 1 authentication requests, and (3) type 2 authentication requests.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
novell	zenworks	—	—
novell	zenworks_desktops	—	—
novell	zenworks_desktops	—	—
novell	zenworks_desktops	—	—
novell	zenworks_server_management	—	—
novell	zenworks_servers	—	—

Detection & IOCs extracted from sources · hover to see the quote

process zenrem32.exe↗

port 1761↗

other 0x10002e06↗

bytes↗

\x00\x06\x05\x01\x10\xe6\x01\x00\x34\x5a\xf4\x77\x80\x95\xf8\x77

bytes↗

\x00\x06metmet\x00\x06metmet\x7F\xFF

bytes↗

\x00\x24 + ("A" * 0x20) + [ target.ret ].pack('V')

• → Monitor for inbound TCP connections to port 1761 (ZENworks Remote Management service). Exploit traffic begins with a 16-byte version identification handshake starting with bytes \x00\x06\x05\x01. ↗
• → Detect the exploit authentication payload pattern on port 1761: a packet containing the sequence \x00\x06 (6-byte field) followed by \x00\x06 (6-byte field) followed by \x7f\xff and then a large payload — indicative of the stack overflow trigger in ZenRem32.exe. ↗
• → Detect the final overflow frame on port 1761: a packet beginning with \x00\x24 followed by 32 bytes of padding and a 4-byte little-endian return address (pop/pop/pop/pop/pop/ret gadget in zencomm.dll). ↗
• → Alert on anomalous process behaviour or crashes in zenrem32.exe (ZENworks Remote Management authentication process), as it is the vulnerable target process for both stack and heap overflow exploitation. ↗

• · The return address (RET gadget 0x10002e06) is hardcoded for a specific version of zencomm.dll on Windows XP/2000/2003 with ZENworks 6.5 Desktop/Server Agent. It will not be reliable across other patch levels or DLL versions. ↗
• · The exploit payload bad character is \x00 (null byte); shellcode encoders must avoid null bytes. The payload space is up to 32767 bytes (0x7FFF), constrained by the \x7f\xff length field in the authentication packet. ↗
• · The vulnerability affects multiple product lines: ZENworks 6.5 Desktop and Server Management, ZENworks for Desktops 4.x, ZENworks for Servers 3.x, and the standalone Remote Management component. Detection should cover all these products. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.