Multiple Vendor XFERWAN.EXE Remote Buffer Overflow Vulnerability

Multiple Vendor XFERWAN.EXE Remote Buffer Overflow Vulnerability

Multiple Vendor products are prone to a remote buffer-overflow vulnerability in 'XFERWAN.EXE'.

The vulnerability arises in the 'CentennialIPTransferServer' service when handling strings in TCP packets.

A remote attacker may trigger a denial-of-service condition or may execute arbitrary code with SYSTEM privileges. This may facilitate a complete compromise of affected systems.

The following versions are reported vulnerable:

Centennial Discovery 2006 Feature Pack 1
Symantec Discovery 6.5
Numara Asset Manager 8.0

Earlier versions of each application may be affected as well.