Submit a Story      Security   FAQ    Resources    Certification    Links    Calendar    Forum    Polls    Search      
User Functions
:

:

Don't have an account yet? Sign up as a New User
Lost your password?

What's New
STORIES
No new stories

COMMENTS last 2 days
No new comments

TRACKBACKS last 2 days
  • GroupWise 2012 no...

  • LINKS last 2 weeks
    No recent new links


    Who's Online
    Guest Users: 10

    Live Novell Chat
    Live Novell Chat

    Topics
    Home
    Poll posts (1/0)
    Way Off Topic! (1/0)
    Contracting (2/0)
    FAQ (1/0)
    NetWare (51/0)
    Certification (31/0)
    NDS/eDir (19/0)
    Administration (78/0)
    GroupWise (143/0)
    Linux/Open Source (309/0)
    Resources (21/0)
    General News (904/0)
    Security (291/0)

    Poll
    How do you think the Attachmate deal will turn out for "Novell"
    Well, the marketing can't be any WORSE
    Better, the product/support commitment is there
    Worse, MS will end up with what is left of Novell’s marketshare & still end up with the patents, leaving the customer as the loser
    Results
    86 votes | 0 comments

    Poll
    Does your company still use Blackberry phones?
    Yes, with BES
    Yes, without BES
    No, we never used Blackberries
    No, we just stopped using them
    No, we stopped using them 6 months ago
    No, we stopped using them 1+ year ago
    Results
    55 votes | 0 comments


     [SA40805] Novell iPrint Client Two Vulnerabilities    
     Author:  kkbass
     Dated:  Friday, August 20 2010 @ 10:49 PM CDT
     Viewed:  388 times  
    General NewsSECUNIA ADVISORY ID:
    SA40805

    VERIFY ADVISORY:
    Secunia.com
    http://secunia.com/advisories/40805/
    Customer Area (Credentials Required)
    https://ca.secunia.com/?page=viewadvisory&vuln_id=40805

    RELEASE DATE:
    2010-08-20

    DISCUSS ADVISORY:
    http://secunia.com/advisories/40805/#comments


    DESCRIPTION:
    Two vulnerabilities have been reported in Novell iPrint Client, which
    can be exploited by malicious people to compromise a user's system.

    1) A boundary error in the handling of the "call-back-url" parameter
    value for a "op-client-interface-version" operation where the
    "result-type" parameter is set to "url" can be exploited to cause a
    stack-based buffer overflow via an overly long "call-back-url"
    parameter value.

    2) An error in PluginGetDriverFile can be exploited to use data in
    uninitialised memory as a pointer.

    Successful exploitation allows execution of arbitrary code when a
    user e.g. visits a malicious website.

    SOLUTION:
    Update to version 5.44.

    Further details available in Customer Area:
    http://secunia.com/products/corporate/EVM/

    PROVIDED AND/OR DISCOVERED BY:
    1) Carsten Eiram, Secunia Research.
    2) Aaron Portnoy, TippingPoint DVLabs.

    ORIGINAL ADVISORY:
    Secunia Research:
    http://secunia.com/secunia_research/2010-104/

    Novell:
    http://www.novell.com/support/viewContent.do?externalId=7006679

    OTHER REFERENCES:
    Further details available in Customer Area:
    http://secunia.com/products/corporate/EVM/

    DEEP LINKS:
    Further details available in Customer Area:
    http://secunia.com/products/corporate/EVM/

    EXTENDED DESCRIPTION:
    Further details available in Customer Area:
    http://secunia.com/products/corporate/EVM/

    EXTENDED SOLUTION:
    Further details available in Customer Area:
    http://secunia.com/products/corporate/EVM/

    EXPLOIT:
    Further details available in Customer Area:
    http://secunia.com/products/corporate/EVM/

    ----------------------------------------------------------------------

    About:
    This Advisory was delivered by Secunia as a free service to help
    private users keeping their systems up to date against the latest
    vulnerabilities.

    Subscribe:
    http://secunia.com/advisories/secunia_security_advisories/

    Definitions: (Criticality, Where etc.)
    http://secunia.com/advisories/about_secunia_advisories/


    Please Note:
    Secunia recommends that you verify all advisories you receive by
    clicking the link.
    Secunia NEVER sends attached files with advisories.
    Secunia does not advise people to install third party patches, only
    use those supplied by the vendor.

    ----------------------------------------------------------------------



    What's Related

    Story Options
  • Mail Story to a Friend
  • Printable Story Format

  • Trackback

    Trackback URL for this entry: http://www.abend.org/trackback.php/20100820224943730

    Here's what others have to say about '[SA40805] Novell iPrint Client Two Vulnerabilities':

    Apple Lessens Its Commitment to Server Market | Techrights
    Tracked on Thursday, August 26 2010 @ 09:20 PM CDT

    [SA40805] Novell iPrint Client Two Vulnerabilities | 0 comments | Create New Account
    The following comments are owned by whomever posted them. This site is not responsible for what they say.