PT-2008-3315 · Novell · Edirectory

Published 2008-04-14 · Updated 2011-03-08 · CVE-2008-1777

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Novell eDirectory version 8.8.2

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by sending a long HTTP HEAD request to TCP port 8028. This affects the eDirectory Host Environment service, which is run by the dhost.exe process.

Recommendations For Novell eDirectory version 8.8.2, consider restricting access to TCP port 8028 to minimize the risk of exploitation. As a temporary workaround, limiting the length of HTTP HEAD requests to the eDirectory Host Environment service may help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-1777

Affected Products

Edirectory

References · 6

• 🔥 http://offensive-security.com/0day/novel-edir.py.txt · Exploit
• 🔥 http://securityfocus.com/bid/28572 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1777 · Security Note
• http://secunia.com/advisories/29639 · Vendor Advisory
• http://vupen.com/english/advisories/2008/1075 · Note
• http://securitytracker.com/id?1019783 · Note