PT-2008-6192 · Microsoft+1 · Windows+2

Published

2008-11-12

·

Updated

2024-02-02

·

CVE-2008-5038

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Novell eDirectory versions 8.7.3 SP10 through 8.7.3 SP10 before FTF1 Novell eDirectory version 8.8 SP2 for Windows
Description The issue is related to a use-after-free vulnerability in the NetWare Core Protocol (NCP) feature. This vulnerability can be exploited by remote attackers through a sequence of "Get NCP Extension Information By Name" requests. The exploitation causes one thread to operate on memory after it has been freed in another thread, leading to memory corruption. This can result in a denial of service and potentially allow the execution of arbitrary code.
Recommendations For Novell eDirectory versions 8.7.3 SP10 through 8.7.3 SP10 before FTF1, update to 8.7.3 SP10 FTF1 to resolve the issue. For Novell eDirectory version 8.8 SP2 for Windows, no specific fix is mentioned, but as a temporary workaround, consider restricting access to the NCP feature until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2008-5038

Affected Products

Netware Core Protocol
Novell Edirectory
Windows