PT-2006-3269 · Novell · Novell Client+1

Publicado 2006-05-11 · Atualizado 2018-10-18 · CVE-2006-2304

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Novell Client versions 4.83 SP3, 4.90 SP2, 4.91 SP2

Description The issue is caused by multiple integer overflows in the DPRPC library, specifically in the ndps xdr array function. This occurs when an XDR encoded array with a field specifying a large number of elements is processed, allowing remote attackers to execute arbitrary code. Initially, this was reported as a buffer overflow by Novell, but it was later determined that the root cause is an integer overflow.

Recommendations For Novell Client version 4.83 SP3, update to a version that fixes the integer overflows in the DPRPC library. For Novell Client version 4.90 SP2, update to a version that fixes the integer overflows in the DPRPC library. For Novell Client version 4.91 SP2, update to a version that fixes the integer overflows in the DPRPC library.

Correção

Identificadores relacionados

CVE-2006-2304

Produtos afetados

Dprpc Library

Novell Client

Referências · 11

• http://support.novell.com/cgi-bin/search/searchtid.cgi?/2973719.htm · Correção
• http://osvdb.org/25429 · Nota
• http://secunia.com/advisories/20048 · Aviso do Fabricante
• http://securityfocus.com/archive/1/434017/100/0/threaded · Nota
• http://hustlelabs.com/novell_ndps_advisory.pdf · Aviso do Fabricante
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046048.html · Nota
• http://securityfocus.com/bid/17931 · Correção
• http://securitytracker.com/id?1016052 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2006-2304 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26314 · Nota
• http://vupen.com/english/advisories/2006/1759 · Nota