Novell iPrint Client 'ienipp.ocx' ActiveX 'GetDriverSettings()' Buffer Overflow Vulnerability
BID:44966
Info
Novell iPrint Client 'ienipp.ocx' ActiveX 'GetDriverSettings()' Buffer Overflow Vulnerability
| Bugtraq ID: | 44966 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2010-4321 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 18 2010 12:00AM |
| Updated: | Mar 07 2011 06:37PM |
| Credit: | Anonymous working with the Zero Day Initiative |
| Vulnerable: |
Novell iPrint Client 5.52 Novell iPrint Client 5.44 Novell iPrint Client 5.32 Novell iPrint Client 5.30 Novell iPrint Client 5.08 Novell iPrint Client 5.06 Novell iPrint Client 5.04 |
| Not Vulnerable: |
Novell iPrint Client 5.56 |
Discussion
Novell iPrint Client 'ienipp.ocx' ActiveX 'GetDriverSettings()' Buffer Overflow Vulnerability
Novell iPrint Client 'ienipp.ocx' ActiveX control is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application (typically Internet Explorer) using the ActiveX control. Failed exploit attempts likely result in denial-of-service conditions.
iPrint Client 5.52 is affected; other versions may also be vulnerable.
Novell iPrint Client 'ienipp.ocx' ActiveX control is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application (typically Internet Explorer) using the ActiveX control. Failed exploit attempts likely result in denial-of-service conditions.
iPrint Client 5.52 is affected; other versions may also be vulnerable.
Exploit / POC
Novell iPrint Client 'ienipp.ocx' ActiveX 'GetDriverSettings()' Buffer Overflow Vulnerability
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploits are available:
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploits are available:
Solution / Fix
Novell iPrint Client 'ienipp.ocx' ActiveX 'GetDriverSettings()' Buffer Overflow Vulnerability
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
Novell iPrint Client 'ienipp.ocx' ActiveX 'GetDriverSettings()' Buffer Overflow Vulnerability
References:
References:
- Microsoft Knowledge Base Article 240797 (Microsoft)
- Novell iPrint Overview (Novell)
- 7007234 Security Vulnerability - Novell iPrint Client server-address Remote Code (Novell)
- iPrint Client for Windows XP/Vista/Win 7 5.56 (Novell)
- ZDI-10-256 Novell iPrint Activex GetDriverSettings Remote Code Execution Vulnera (Zero Day Initiative)