PT-2006-5314 · Novell+1 · Novell Imanager+1

Published 2006-11-01 · Updated 2017-07-20 · CVE-2006-4517

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Novell iManager versions 2.0.2 through 2.5

Description The issue allows remote attackers to cause a denial of service in the Tomcat server. This is achieved by sending an HTTP POST with a long TREE parameter, which triggers a NULL pointer dereference, causing the server to crash.

Recommendations For Novell iManager version 2.0.2, restrict access to the Tomcat server to minimize the risk of exploitation. For Novell iManager version 2.5, avoid using long TREE parameters in HTTP POST requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-189

CWE-399

Related Identifiers

CVE-2006-4517

Affected Products

Novell Imanager

Apache Tomcat

References · 8

• http://novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=3885713&sliceId=SAL_Public&dialogID=17090866&stateId=0%200%2017098735 · Vendor Advisory
• http://securityfocus.com/bid/20841 · Patch
• http://vupen.com/english/advisories/2006/4292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4517 · Security Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=436 · Patch
• http://secunia.com/advisories/22657 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29961 · Note
• http://securitytracker.com/id?1017139 · Note