|
|
[ Message Precedent sur la mailing][ Message Suivant sur la mailing][ Precedent dans le fil][ Prochain dans le fil][ Index par Date][ Index par fil]
[Full-disclosure] Secunia Research: Novell eDirectory iMonitor "Accept-Language" Buffer Overflow
======================================================================
Secunia Research 14/07/2009
- Novell eDirectory iMonitor "Accept-Language" Buffer Overflow -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10
======================================================================
1) Affected Software
* Novell eDirectory 8.8 SP3 and 8.8 SP3 FTF3
NOTE: Other versions may also be affected.
======================================================================
2) Severity
Rating: Less critical
Impact: Denial of Service
Where: Local network
======================================================================
3) Vendor's Description of Software
"... Novell eDirectory is an LDAP directory service, and forms the
basis for many of the world's largest identity-management deployments.
Since its debut more than ten years ago, eDirectory has been trusted
for its scalability, compatibility, reliability, manageability and
security".
Product Link:
link://[click]
======================================================================
4) Description of Vulnerability
Secunia Research has discovered a vulnerability in Novell eDirectory,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
The vulnerability is caused due to an off-by-one error in the iMonitor
component when processing HTTP requests. This can be exploited to
cause a stack-based buffer overflow via an HTTP request having a
specially crafted "Accept-Language" header.
======================================================================
5) Solution
Update to version 8.8 SP5.
======================================================================
6) Time Table
05/03/2009 - Vendor notified.
11/03/2009 - Vendor response.
14/07/2009 - Public disclosure due to the release of 8.8 SP5.
======================================================================
7) Credits
Discovered by Alin Rad Pop, Secunia Research.
======================================================================
8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2009-0192 for the vulnerability.
======================================================================
9) About Secunia
Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:
link://[click]
Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.
link://[click]
Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:
link://[click]
Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:
link://[click]
Secunia offers a FREE mailing list called Secunia Security Advisories:
link://[click]
======================================================================
10) Verification
Please verify this advisory by visiting the Secunia website:
link://[click]
Complete list of vulnerability reports published by Secunia Research:
link://[click]
======================================================================
Full-Disclosure - We believe in it.
Charter: link://[click]
Hosted and sponsored by Secunia - link://[click]
Archives de la liste de diffusion Secunia
Archives de la liste de diffusion Full Disclosure
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
