PT-2011-5215 · Novell+1 · Novell-Novfsd+2

Published 1970-01-01 · Updated 2012-01-02 · CVE-2011-1710

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions novell-xtier-base versions 3.1.8 novell-novfsd (affected versions not specified)

Description The issue affects the Novell XTier framework and novell-novfsd package in SUSE Linux Enterprise, potentially leading to disruption of confidentiality, integrity, and availability of protected information. Exploitation can be done remotely. Specifically, multiple integer overflows in the HTTP server of the Novell XTier framework allow remote attackers to cause a denial of service or possibly execute arbitrary code via crafted header length variables, such as header length variables.

Recommendations For novell-xtier-base version 3.1.8, consider updating to a version that fixes the integer overflows in the HTTP server. For novell-novfsd, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-04427

BDU:2015-04428

CVE-2011-1710

Affected Products

Suse Linux Enterprise

Novell-Novfsd

Novell-Xtier-Base

References · 7

• https://bdu.fstec.ru/vul/2015-04427 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-1710 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00012.html · Vendor Advisory
• http://download.novell.com/patch/finder/?keywords=b8833ce91ca8c8d2a478a8a32a2e2efb · Patch
• https://bdu.fstec.ru/vul/2015-04428 · Security Note
• http://support.novell.com/security/cve/CVE-2011-1710.html · Note
• https://bugzilla.novell.com/585440 · Note