Novell Client NWSPOOL.DLL Remote Buffer Overflow Vulnerability

Bugtraq ID:	21220
Class:	Boundary Condition Error
CVE:	CVE-2006-5854
Remote:	Yes
Local:	No
Published:	Nov 21 2006 12:00AM
Updated:	Jan 29 2007 11:30PM
Credit:	An anonymous researcher discovered this issue.
Vulnerable:	Novell Client 4.91 SP3 Novell Client 4.91 SP2 - Microsoft Windows 2000 Professional SP4 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Novell Client 4.91 SP1 Novell Client 4.91
Not Vulnerable:

Novell Client NWSPOOL.DLL Remote Buffer Overflow Vulnerability

Novell Client is prone to a remote buffer-overflow vulnerability. Successful exploits may result in a denial-of-service condition or arbitrary code execution. Remote, anonymous attackers may exploit this issue via RPC requests.

This issue affects Novell Client 4.91; other versions may also be vulnerable.

Novell Client NWSPOOL.DLL Remote Buffer Overflow Vulnerability

An exploit for members of the Immunity Partners program is available. This exploit is not known to be publicly available.

The following exploit code is available:

• /data/vulnerabilities/exploits/testlpc.c

Novell Client NWSPOOL.DLL Remote Buffer Overflow Vulnerability

Solution:
Novell has released an advisory along with fixes to address this issue. Please see the references for more information.


Novell Client 4.91

• Novell 491psp3_nwspool.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/491psp3_nwspool .exe

Novell Client 4.91 SP3

• Novell 491psp3_nwspool.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/491psp3_nwspool .exe

Novell Client 4.91 SP1

• Novell 491psp3_nwspool.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/491psp3_nwspool .exe

Novell Client 4.91 SP2

• Novell 491psp3_nwspool.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/491psp3_nwspool .exe

Novell Client NWSPOOL.DLL Remote Buffer Overflow Vulnerability

References:

• Novell Client 4.91 Post-SP3 NWSPOOL.DLL - TID2974765 (Novell)
  
• Novell Client Product Homepage (Novell)
  
• nwspool.dll buffer overflow (Novell)
  
• ZDI-06-043: Novell Netware Client Print Provider Buffer Overflow Vulnerability ([email protected])