Home page logo

bugtraq logo Bugtraq mailing list archives

DDIVRT-2007-05 NetSupport Manager Client Buffer Overflow
From: vulnerabilityresearch () digitaldefense net
Date: 4 Oct 2007 20:55:53 -0000

NetSupport Manager Client Buffer Overflow


Date Discovered

Discovered By
Digital Defense, Inc. Vulnerability Research Team Credit Given To: sxkeebler and r () b13$ 

Vulnerability Description
The NetSupport Manager client that listens on TCP port 5405 does not properly validate input supplied during the 
initial connection sequence. 
Specifically, during the configuration exchange part of the initial connection setup, the client does not appear to 
validate the supplied data which can result in a DoS of the NetSupport Manager Client.  Remote code exploitation is 
also thought to be possible.  Within Technical Document ID TD545, NetSupport acknowledges that this flaw is present in 
unspecified versions of NetSupport School Student.

Solution Description
Digital Defense, Inc. notified NetSupport on September 9, 2007 of this flaw but did not receive any response or 
acknowledgement from the vendor. 
However, NetSupport has released a patch for this flaw as described by NetSupport Technical Document ID TD545.  

Tested Systems / Software (with versions)
NetSupport Manager 10.20 running on Windows XP SP2 and Windows 2K3 SP2.  

NetSupport acknowledges in Technical Document ID TD545 that the following versions of the NetSupport Manager are 
vulnerable to this flaw:

NSM 10.00, NSS 9.00, NSM 10.20

Vendor Contact

  By Date           By Thread  

Current thread:
  • DDIVRT-2007-05 NetSupport Manager Client Buffer Overflow vulnerabilityresearch (Oct 04)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]