PT-2008-5713 · Novell · Netware Core Protocol+2

Sebastian Apelt · Published 2008-10-14 · Updated 2018-11-02 · CVE-2008-4480

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Novell eDirectory versions prior to 8.8.3 Novell eDirectory version 8.7.3 before 8.7.3.10 ftf1

Description: The issue is related to a heap-based buffer overflow in dhost.exe. It allows remote attackers to execute arbitrary code via a crafted Netware Core Protocol opcode 0x24 message. This message triggers a calculation error that under-allocates a heap buffer.

Recommendations: For Novell eDirectory versions prior to 8.8.3, update to version 8.8.3 or later. For Novell eDirectory version 8.7.3, apply the fix before 8.7.3.10 ftf1.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-4480

Affected Products

Netware Core Protocol

Novell Edirectory

Dhost.Exe

References · 12

• http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037180.html · Vendor Advisory
• http://novell.com/support/viewContent.do?externalId=3477912 · Vendor Advisory
• http://novell.com/support/viewContent.do?externalId=3426981 · Vendor Advisory
• http://novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7001183&sliceId=1&docTypeID=DT_TID_1_1&dialogID=78066829&stateId=0%200%2078062953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4480 · Security Note
• http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037181.html · Vendor Advisory
• http://securityreason.com/securityalert/4404 · Note
• http://securitytracker.com/id?1020990 · Note
• http://vupen.com/english/advisories/2008/2738 · Note
• http://secunia.com/advisories/32111 · Note
• http://securityfocus.com/archive/1/497169/100/0/threaded · Note
• http://zerodayinitiative.com/advisories/ZDI-08-066 · Note