Vulnerabilities > CVE-2008-4480 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Novell Edirectory

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
novell
CWE-119
critical
nessus
NVD
Published: 2008-10-14
Updated: 2018-11-02

Summary

Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.x before 8.8.3, and 8.7.3 before 8.7.3.10 ftf1, allows remote attackers to execute arbitrary code via a crafted Netware Core Protocol opcode 0x24 message that triggers a calculation error that under-allocates a heap buffer.

Vulnerable Configurations

Part Description Count
Application
Novell
15

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

NASL familyMisc.
NASL idEDIRECTORY_873SP10_MULTIPLE_VULNS.NASL
descriptionThe remote host is running eDirectory, a directory service software from Novell. The installed version of Novell eDirectory is affected by multiple heap overflows and denial of service vulnerabilities : - DS module is affected by two heap overflow vulnerabilities (Bugs 407275, 407256). - EMBOX module is affected by two denial of service vulnerabilities (Bugs 407243, 407245).
last seen2020-06-01
modified2020-06-02
plugin id34349
published2008-10-07
reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/34349
titleNovell eDirectory < 8.7.3 SP10 FTF1 Multiple Vulnerabilities

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 31553 CVE ID：CVE-2008-4478 CVE-2008-4479 CVE-2008-4480 CNCVE ID：CNCVE-20084478 CNCVE-20084479 CNCVE-20084480 Novell eDirectory是一款支持轻量目录访问协议(LDAP)并基于目录的身份管理系统。 Novell eDirectory存在多个缓冲区溢出如下： -WEB控制台运行在TCP 8028和8030端口存在一个缺陷，服务器导出WEB接口并接收SOAP连接。当解析SOAP请求中的Content-Length头字段时存在一个整数溢出。整数溢出可导致在之后的内存拷贝操作过程中触发溢出而导致以SYSTEM用户权限执行任意代码。 -WEB控制台运行在TCP 8028和8030端口存在一个缺陷，服务器导出WEB接口并接收SOAP连接。当服务拷贝SOAP请求中的Accept-Language头字段到固定大小的缓冲区时缺少充分边界检查，攻击者发送特殊构建的请求可导致内存拷贝操作中触发溢出而以SYSTEM用户权限执行任意代码。 -负责目录复制的服务dhost.exe默认绑定TCP 524端口，通过Netware Core协议不正确解析opcode 0x0F可导致数学计算错误而触发整数溢出，可导致任意代码执行。 -负责目录复制的服务dhost.exe默认绑定TCP 524端口，通过Netware Core协议不正确解析opcode 0x24可导致数学计算错误而触发整数溢出，可导致任意代码执行。 Novell eDirectory 8.7.3 SP10b Novell eDirectory 8.7.3 10 可参考如下安全公告获得补丁信息： <a href=http://www.novell.com/support/viewContent.do?externalId=3477912 target=_blank>http://www.novell.com/support/viewContent.do?externalId=3477912</a>
idSSV:4183
last seen2017-11-19
modified2008-10-09
published2008-10-09
reporterRoot
titleNovell eDirectory多个缓冲区溢出漏洞

References