Vulnerability record · CVE-2011-3176 · published 9 April 2012
CVE-2011-3176: Novell ZENworks Preboot Service stack buffer overflow
Novell · Zenworks Configuration Management
The Preboot Service in Novell ZENworks Configuration Management 11.1 and 11.1a contains a stack-based buffer overflow reachable through an opcode 0x4c request. A remote, unauthenticated attacker can trigger it to corrupt memory and execute arbitrary code on the affected host.
Description
Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x4c request.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
high priorityRemote, unauthenticated code execution with a CVSS 2.0 score of 10 and very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is documented.
What it is
The Preboot Service in Novell ZENworks Configuration Management 11.1 and 11.1a contains a stack-based buffer overflow reachable through an opcode 0x4c request. A remote, unauthenticated attacker can trigger it to corrupt memory and execute arbitrary code on the affected host.
Impact
Successful exploitation gives the attacker arbitrary code execution in the context of the Preboot Service, which typically runs with elevated privileges on the managed endpoint. That can lead to full compromise of the host and any managed systems it controls.
Attack surface
The flaw is network-reachable (AV:N) with low complexity and no authentication (Au:N), and no user interaction is indicated by the vector. Any host that can reach the Preboot Service port can send the crafted opcode 0x4c request.
Exploitation
The record is not listed in CISA KEV, but EPSS is very high (0.70, 99.3rd percentile) and a public Exploit-DB entry (19959) exists, indicating exploit code is available. No ransomware association is documented.
What to do
- Apply the Novell ZENworks Configuration Management patch referenced in the vendor readme (patchbuilder readme_5127930) and the Novell download/support links.
- If patching cannot be done immediately, restrict network access to the Preboot Service to trusted management subnets only.
- Segment or firewall the Preboot Service port so it is not reachable from untrusted networks.
- Monitor vendor advisories for updated builds and verify the installed ZCM version is no longer 11.1 or 11.1a.
- Where feasible, run the Preboot Service with least privilege and isolate managed endpoints from broad network exposure.
Detection
- Monitor network traffic to the Preboot Service for opcode 0x4c requests, especially from unexpected source addresses.
- Watch for crashes or restarts of the Preboot Service process, which can indicate a failed overflow attempt.
- Alert on anomalous child processes or command execution spawned by the Preboot Service.
- Review host logs for signs of memory corruption or unexpected service termination on ZCM-managed endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2011-3176 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2011-3176), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
