TITLE: Novell eDirectory NDS Verb 0x1 Request Integer Overflow Vulnerability SECUNIA ADVISORY ID: SA37554 VERIFY ADVISORY: http://secunia.com/advisories/37554/ DESCRIPTION: A vulnerability has been reported in Novell eDirectory, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to an integer overflow when processing NDS Verb 0x1 service requests. This can be exploited to cause a heap-based buffer overflow via specially crafted requests. Successful exploitation may allow the execution of arbitrary code. The vulnerability is reported in version 8.7.3.10 ftf1 and 8.8.5 ftf1. Prior versions may also be affected. SOLUTION: Apply patches. eDirectory 8.7.3.X: Update to version 8.7.3.10 ftf2. eDirectory 8.8.X: Update to version 8.8.5.2. PROVIDED AND/OR DISCOVERED BY: Chris Valasek and John McDonald, IBM X-Force ORIGINAL ADVISORY: Novell: http://www.novell.com/support/viewContent.do?externalId=7004912 IBM X-Force: http://www.iss.net/threats/356.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ----------------------------------------------------------------------

What's Related http://secunia.com/advi... http://www.novell.com/s... http://www.iss.net/thre... http://secunia.com/advi... http://secunia.com/advi... More by kkbass More from Security

Story Options Mail Story to a Friend Printable Story Format

Trackback

Trackback URL for this entry: http://www.abend.org/trackback.php/20091203120931582

http://boycottnovell.com/2009/12/05/edirectory-patched/
Tracked on Saturday, December 05 2009 @ 10:16 AM CST

[SA37554] Novell eDirectory NDS Verb 0x1 Request Integer Overflow Vulnerability | 0 comments | Create New Account

Newest First Oldest First Flat Nested No Comments Threaded

The following comments are owned by whomever posted them. This site is not responsible for what they say.