Novell iManager Long TREE Field Off-By-One Denial of Service Vulnerability

Bugtraq ID:	40485
Class:	Boundary Condition Error
CVE:	CVE-2010-1930
Remote:	Yes
Local:	No
Published:	Jun 23 2010 12:00AM
Updated:	Jun 23 2010 12:00AM
Credit:	Francisco Falcon from Core Security Technologies
Vulnerable:	Novell iManager 2.7.3 Novell iManager 2.7.2 Novell iManager 2.7.1 Novell iManager 2.5 Novell iManager 2.0.2 Novell iManager 2.0 Novell iManager 1.5 Novell iManager 2.7.3 FTF2 Novell iManager 2.7.0 Novell iManager 2.6.0
Not Vulnerable:	Novell iManager 2.7.4 Novell iManager 2.7.3 FTF4

Novell iManager Long TREE Field Off-By-One Denial of Service Vulnerability

Novell iManager is prone to a denial-of-service vulnerability due to an off-by-one error.

Attackers may exploit this issue to crash the affected application, denying service to legitimate users.

Novell iManager Long TREE Field Off-By-One Denial of Service Vulnerability

An attacker can use readily available network utilities:

• /data/vulnerabilities/exploits/40479.py

Novell iManager Long TREE Field Off-By-One Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Note: Core Security Technologies has stated that Novell will be releasing updated packages in August 2010. Please see the references for more information

Novell iManager Long TREE Field Off-By-One Denial of Service Vulnerability

References:

• CORE-2010-0316: Novell iManager Multiple Vulnerabilities (Core Security Technologies)
  
• iManager Homepage (Novell)