Novell eDirectory eMBox Utility 'edirutil' Command Unspecified Vulnerability

Bugtraq ID:	28441
Class:	Unknown
CVE:	CVE-2008-0926
Remote:	Yes
Local:	No
Published:	Mar 25 2008 12:00AM
Updated:	May 05 2008 11:05PM
Credit:	Nicholas Gregorie
Vulnerable:	Novell eDirectory 8.7.3 .8 pre-SP9 Novell eDirectory 8.7.3 .8 Novell eDirectory 8.7.3 Novell eDirectory 8.7.1 SU1 Novell eDirectory 8.7.1 Novell eDirectory 8.7 Novell eDirectory 8.6.2 Novell eDirectory 8.5.27 Novell eDirectory 8.5.12 a Novell eDirectory 8.5 Novell eDirectory 8.0 Novell eDirectory 8.8 Novell eDirectory 8.7.3.9
Not Vulnerable:	Novell eDirectory 8.8.2

Novell eDirectory eMBox Utility 'edirutil' Command Unspecified Vulnerability

Novell eDirectory is prone to an unspecified vulnerability that can result in unauthorized file access or a denial of service.

Unauthenticated attackers can exploit this issue.

This issue affects eDirectory 8.8 (and earlier) as well as 8.7.3.9 (and earlier).

Novell eDirectory eMBox Utility 'edirutil' Command Unspecified Vulnerability

The following exploit information is available from Davy Douhine <[email protected]>:

java -cp eMBoxClient.jar embox -i
login -s edir_ip_address -p port (port can be 8008, 8009, 80, 443, 8030)

Novell eDirectory eMBox Utility 'edirutil' Command Unspecified Vulnerability

Solution:
eDirectory 8.8 users can install eDirectory 8.8.2 to address this issue. Please contact the vendor for information on how to obtain and apply the updated version.

Novell eDirectory eMBox Utility 'edirutil' Command Unspecified Vulnerability

References:

• eDirectory Product Homepage (Novell)
  
• Novell eDirectory unauthenticated access to SOAP interface (Nicob )
  
• Security Vulnerability - Unauthenticated SOAP "eMBox" interface (Novell)