PT-2009-3486 · Novell · Novell Edirectory

Published 2009-12-03 · Updated 2017-08-17 · CVE-2009-0895

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Novell eDirectory versions 8.7.3.x through 8.7.3.10 ftf1 and versions 8.8.x through 8.8.5.1

Description The issue is caused by an integer overflow that allows remote attackers to execute arbitrary code via an NDS Verb 0x1 request containing a large integer value, triggering a heap-based buffer overflow.

Recommendations For Novell eDirectory versions 8.7.3.x through 8.7.3.10 ftf1, update to version 8.7.3.10 ftf2 or later. For Novell eDirectory versions 8.8.x through 8.8.5.1, update to version 8.8.5.2 or later.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-0895

Affected Products

Novell Edirectory

References · 9

• http://secunia.com/advisories/37554 · Vendor Advisory
• http://vupen.com/english/advisories/2009/3379 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0895 · Security Note
• http://novell.com/support/viewContent.do?externalId=7004912 · Vendor Advisory
• http://securityfocus.com/bid/37184 · Note
• https://bugzilla.novell.com/show_bug.cgi?id=545887 · Note
• https://bugzilla.novell.com/show_bug.cgi?id=524344 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50616 · Note
• http://iss.net/threats/356.html · Note