Novell iPrint Client Remote Buffer Overflow Vulnerabilities

Bugtraq ID:	37242
Class:	Boundary Condition Error
CVE:	CVE-2009-1568 CVE-2009-1569
Remote:	Yes
Local:	No
Published:	Dec 07 2009 12:00AM
Updated:	Feb 08 2010 01:11PM
Credit:	Carsten Eiram
Vulnerable:	Novell iPrint Client 5.30
Not Vulnerable:	Novell iPrint Client 5.32

Novell iPrint Client Remote Buffer Overflow Vulnerabilities

Novell iPrint Client is prone to remote buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may exploit these issues to execute arbitrary code. Failed attacks will cause denial-of-service conditions.

These issues affect Novell iPrint Client 5.30; other versions may also be affected.

Novell iPrint Client Remote Buffer Overflow Vulnerabilities

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following Metasploit exploit module is available:

• /data/vulnerabilities/exploits/37242.rb

Novell iPrint Client Remote Buffer Overflow Vulnerabilities

Solution:
Updates are available. Please see the references for details.


Novell iPrint Client 5.30

• Novell iPrint Client for Windows XP/Vista/Win7 5.32
  http://download.novell.com/Download?buildid=29T3EFRky18~

Novell iPrint Client Remote Buffer Overflow Vulnerabilities

References:

• Novell Homepage (Novell)
  
• Novell iPrint Client Date/Time Parsing Buffer Overflow (Secunia)
  
• Novell iPrint Client target-frame Parameter Buffer Overflow (Secunia)
  
• Secunia Research: Novell iPrint Client Date/Time Parsing Buffer Overflow (Secunia Research )
  
• Secunia Research: Novell iPrint Client target-frame' Parameter Buffer Overflow (Secunia Research )