PT-2008-3899 · Novell · Novell Iprint Activex Control+1
Publicado
2008-11-26
·
Atualizado
2017-08-08
·
CVE-2008-2431
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Novell iPrint Client versions prior to 5.06
Description:
The issue allows remote attackers to execute arbitrary code by exploiting multiple buffer overflows in the Novell iPrint ActiveX control, specifically through methods such as
GetDriverFile, GetPrinterURLList, GetPrinterURLList2, GetFileList, GetServerVersion, GetResourceList, DeleteResource, UploadPrinterDriver, UploadResource, and GetDriverSettings. This can be achieved by passing long arguments to these methods, including a long uploadPath argument to UploadPrinterDriver or UploadResource methods, or a long string in the arguments to the GetDriverSettings method. The vulnerability is related to the nipplib.dll and exploitation of these methods can lead to arbitrary code execution.Recommendations:
For Novell iPrint Client versions prior to 5.06, consider updating to version 5.06 or later to resolve the issue. As a temporary workaround, consider restricting access to the Novell iPrint ActiveX control and its related methods until a patch is applied. Avoid using long arguments in the
GetDriverFile, GetPrinterURLList, GetPrinterURLList2, GetFileList, GetServerVersion, GetResourceList, DeleteResource, UploadPrinterDriver, UploadResource, and GetDriverSettings methods to minimize the risk of exploitation.Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Novell Iprint Activex Control
Novell Iprint Client