CVE-2011-3174

Name of the Vulnerable Software and Affected Versions Novell ZENworks Configuration Management (ZCM) versions 10.2 through 11 SP1

Description The issue is related to a buffer overflow in the DoFindReplace function of the ISGrid.Grid2.1 ActiveX control. This can be exploited by remote attackers to execute arbitrary code via a long bstrReplaceText parameter.

Recommendations For versions 10.2 through 11 SP1, consider disabling the DoFindReplace function in the ISGrid.Grid2.1 ActiveX control as a temporary workaround until a patch is available. Restrict access to the ISGrid2.dll to minimize the risk of exploitation. Avoid using the bstrReplaceText parameter in the affected ActiveX control until the issue is resolved.