PT-2008-3904 · Novell · Novell Iprint Activex Control+1

Carsten Eiram · Publicado 2008-09-05 · Atualizado 2018-10-11 · CVE-2008-2436

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Novell iPrint Client versions 4.x before 4.38 Novell iPrint Client versions 5.x before 5.08

Description: The issue is related to multiple heap-based buffer overflows in the IppCreateServerRef function. This can be exploited by remote attackers to execute arbitrary code via a long argument to certain functions in the Novell iPrint ActiveX control. The affected functions include GetPrinterURLList, GetPrinterURLList2, and GetFileList2.

Recommendations: For Novell iPrint Client versions 4.x before 4.38, update to version 4.38 or later. For Novell iPrint Client versions 5.x before 5.08, update to version 5.08 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-2436

Produtos afetados

Novell Iprint Activex Control

Novell Iprint Client

Referências · 9

• http://securityreason.com/securityalert/4228 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2436 · Nota de Segurança
• http://vupen.com/english/advisories/2008/2481 · Nota
• http://securityfocus.com/bid/30986 · Nota
• http://secunia.com/advisories/31370 · Aviso do Fabricante
• http://secunia.com/secunia_research/2008-33/advisory · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44853 · Nota
• http://securityfocus.com/archive/1/495940/100/0/threaded · Nota
• http://securitytracker.com/id?1020806 · Nota