PT-2006-5314 · Novell+1 · Novell Imanager+1

Publicado 2006-11-01 · Atualizado 2017-07-20 · CVE-2006-4517

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Novell iManager versions 2.0.2 through 2.5

Description The issue allows remote attackers to cause a denial of service in the Tomcat server. This is achieved by sending an HTTP POST with a long TREE parameter, which triggers a NULL pointer dereference, causing the server to crash.

Recommendations For Novell iManager version 2.0.2, restrict access to the Tomcat server to minimize the risk of exploitation. For Novell iManager version 2.5, avoid using long TREE parameters in HTTP POST requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Enumeração de Fraquezas

CWE-189

CWE-399

Identificadores relacionados

CVE-2006-4517

Produtos afetados

Novell Imanager

Apache Tomcat

Referências · 8

• http://novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=3885713&sliceId=SAL_Public&dialogID=17090866&stateId=0%200%2017098735 · Aviso do Fabricante
• http://securityfocus.com/bid/20841 · Correção
• http://vupen.com/english/advisories/2006/4292 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-4517 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29961 · Nota
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=436 · Correção
• http://securitytracker.com/id?1017139 · Nota
• http://secunia.com/advisories/22657 · Aviso do Fabricante