PT-2009-3486 · Novell · Novell Edirectory

Publicado 2009-12-03 · Atualizado 2017-08-17 · CVE-2009-0895

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Novell eDirectory versions 8.7.3.x through 8.7.3.10 ftf1 and versions 8.8.x through 8.8.5.1

Description The issue is caused by an integer overflow that allows remote attackers to execute arbitrary code via an NDS Verb 0x1 request containing a large integer value, triggering a heap-based buffer overflow.

Recommendations For Novell eDirectory versions 8.7.3.x through 8.7.3.10 ftf1, update to version 8.7.3.10 ftf2 or later. For Novell eDirectory versions 8.8.x through 8.8.5.1, update to version 8.8.5.2 or later.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2009-0895

Produtos afetados

Novell Edirectory

Referências · 9

• http://secunia.com/advisories/37554 · Aviso do Fabricante
• http://securityfocus.com/bid/37184 · Nota
• https://bugzilla.novell.com/show_bug.cgi?id=545887 · Nota
• http://vupen.com/english/advisories/2009/3379 · Aviso do Fabricante
• https://bugzilla.novell.com/show_bug.cgi?id=524344 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0895 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50616 · Nota
• http://novell.com/support/viewContent.do?externalId=7004912 · Aviso do Fabricante
• http://iss.net/threats/356.html · Nota