PT-2007-1171 · Novell · Novell Edirectory

Published 2007-04-30 · Updated 2017-07-20 · CVE-2006-4520

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Novell eDirectory versions prior to 8.7.3 SP9 Novell eDirectory versions 8.8.x prior to 8.8.1 FTF2

Description: The issue is related to the handling of NCP fragments with a negative length by ncp in Novell eDirectory. This improper handling allows remote attackers to cause a denial of service, resulting in a daemon crash when the heap is written to a log file.

Recommendations: For Novell eDirectory versions prior to 8.7.3 SP9, update to version 8.7.3 SP9 or later. For Novell eDirectory versions 8.8.x prior to 8.8.1 FTF2, update to version 8.8.1 FTF2 or later.

Fix

Related Identifiers

CVE-2006-4520

Affected Products

Novell Edirectory

References · 7

• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=518 · Vendor Advisory
• http://novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=3924657&sliceId=SAL_Public · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-4520 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33921 · Note
• http://vupen.com/english/advisories/2007/1550 · Note
• http://securitytracker.com/id?1017972 · Note
• http://securityfocus.com/bid/23685 · Note