PT-2008-3904 · Novell · Novell Iprint Activex Control+1

Carsten Eiram · Published 2008-09-05 · Updated 2018-10-11 · CVE-2008-2436

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Novell iPrint Client versions 4.x before 4.38 Novell iPrint Client versions 5.x before 5.08

Description: The issue is related to multiple heap-based buffer overflows in the IppCreateServerRef function. This can be exploited by remote attackers to execute arbitrary code via a long argument to certain functions in the Novell iPrint ActiveX control. The affected functions include GetPrinterURLList, GetPrinterURLList2, and GetFileList2.

Recommendations: For Novell iPrint Client versions 4.x before 4.38, update to version 4.38 or later. For Novell iPrint Client versions 5.x before 5.08, update to version 5.08 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-2436

Affected Products

Novell Iprint Activex Control

Novell Iprint Client

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2008-2436 · Security Note
• http://secunia.com/advisories/31370 · Vendor Advisory
• http://secunia.com/secunia_research/2008-33/advisory · Vendor Advisory
• http://securityreason.com/securityalert/4228 · Note
• http://vupen.com/english/advisories/2008/2481 · Note
• http://securityfocus.com/bid/30986 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44853 · Note
• http://securityfocus.com/archive/1/495940/100/0/threaded · Note
• http://securitytracker.com/id?1020806 · Note