PT-2010-2380 · Novell · Nwftpd.Nlm+1

Francis Provencher + 1 · Published 2010-04-05 · Updated 2018-10-10 · CVE-2010-0625

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Novell NetWare versions 5.1 through 6.5 SP8 with NWFTPD.nlm before 5.10.01

Description The issue is related to a stack-based buffer overflow in the FTP server, allowing remote authenticated users to potentially execute arbitrary code or cause a denial of service by crashing the daemon. This can be achieved through a long command, specifically the MKD, RMD, RNFR, or DELE commands.

Recommendations For Novell NetWare versions 5.1 through 6.5 SP8 with NWFTPD.nlm before 5.10.01, update NWFTPD.nlm to version 5.10.01 or later to resolve the issue.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-0625

ZDI-10-062

Affected Products

Nwftpd.Nlm

Novell Netware

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2010-0625 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-10-062 · Security Note
• http://vupen.com/english/advisories/2010/0742 · Vendor Advisory
• http://secunia.com/advisories/39151 · Vendor Advisory
• http://securityfocus.com/archive/1/510557/100/0/threaded · Note
• http://novell.com/support/viewContent.do?externalId=3238588&sliceId=1 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0625 · Note
• http://protekresearchlab.com/index.php?option=com_content&view=article&id=12&Itemid=12 · Note
• http://securitytracker.com/id?1023768 · Note
• http://securityfocus.com/bid/39041 · Note
• https://bugzilla.novell.com/show_bug.cgi?id=569496 · Note
• http://securityfocus.com/archive/1/510353/100/0/threaded · Note
• http://zerodayinitiative.com/advisories/ZDI-10-062 · Note