Novell eDirectory EvtFilteredMonitorEventsRequest Multiple Vulnerabilities
BID:20663
Info
Novell eDirectory EvtFilteredMonitorEventsRequest Multiple Vulnerabilities
| Bugtraq ID: | 20663 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2006-4509 CVE-2006-4510 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 22 2006 12:00AM |
| Updated: | Oct 24 2006 05:03AM |
| Credit: | The discoverer of the heap overflow remains anonymous and the discoverer of the invalid-free vulnerability is Joshua J. Drake. |
| Vulnerable: |
Novell eDirectory 8.8.1 Novell eDirectory 8.8 |
| Not Vulnerable: | |
Discussion
Novell eDirectory EvtFilteredMonitorEventsRequest Multiple Vulnerabilities
The Novell eDirectory server is prone to buffer-overflow and invalid-free vulnerabilities because it fails to perform sufficient bounds checking on client-supplied data before copying it to a buffer or referencing a value outside of an array.
An attacker could leverage these issues to have arbitrary code execute with administrative privileges. A successful exploit could result in a denial of service or code execution, possibly leading to the complete compromise of the affected system.
eDirectory 8.8/8.8.1 are vulnerable to these issues; prior versions may be affected as well.
The Novell eDirectory server is prone to buffer-overflow and invalid-free vulnerabilities because it fails to perform sufficient bounds checking on client-supplied data before copying it to a buffer or referencing a value outside of an array.
An attacker could leverage these issues to have arbitrary code execute with administrative privileges. A successful exploit could result in a denial of service or code execution, possibly leading to the complete compromise of the affected system.
eDirectory 8.8/8.8.1 are vulnerable to these issues; prior versions may be affected as well.
Exploit / POC
Novell eDirectory EvtFilteredMonitorEventsRequest Multiple Vulnerabilities
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]
Solution / Fix
Novell eDirectory EvtFilteredMonitorEventsRequest Multiple Vulnerabilities
Solution:
Novell is addressing these issues with FTF packages. Please see the references for information on how obtain and apply these fixes.
Novell eDirectory 8.8.1
Solution:
Novell is addressing these issues with FTF packages. Please see the references for information on how obtain and apply these fixes.
Novell eDirectory 8.8.1
-
Novell eDirectory 8.8.1 FTF1 Linux/UNIX
http://support.novell.com/servlet/filedownload/sec/pub/edir881ftf_1.tg z/ -
Novell eDirectory 8.8.1 FTF1 Windows
http://support.novell.com/servlet/filedownload/sec/pub/edir881ftf_1.ex e/
References
Novell eDirectory EvtFilteredMonitorEventsRequest Multiple Vulnerabilities
References:
References: