Vulnerabilities > CVE-2010-4321 - Buffer Errors vulnerability in Novell Iprint Client 5.52

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
novell
CWE-119
critical
nessus
exploit available
metasploit
NVD
Published: 2010-12-30
Updated: 2011-09-21

Summary

Stack-based buffer overflow in an ActiveX control in ienipp.ocx in Novell iPrint Client 5.52 allows remote attackers to execute arbitrary code via a long argument to (1) the GetDriverSettings2 method, as reachable by (2) the GetDriverSettings method.

Vulnerable Configurations

Part Description Count
Application
Novell
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Exploit-Db

  • descriptionNovell iPrint Client ActiveX Control. CVE-2010-4321. Remote exploit for windows platform
    idEDB-ID:16956
    last seen2016-02-02
    modified2011-03-07
    published2011-03-07
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/16956/
    titleNovell iPrint Client ActiveX Control <= 5.52 - Buffer Overflow
  • descriptionNovell iPrint <= 5.52 - ActiveX GetDriverSettings() Remote Exploit (ZDI-10-256). CVE-2010-4321. Remote exploit for windows platform
    fileexploits/windows/remote/16014.html
    idEDB-ID:16014
    last seen2016-02-01
    modified2011-01-19
    platformwindows
    port
    published2011-01-19
    reporterDr_IDE
    sourcehttps://www.exploit-db.com/download/16014/
    titleNovell iPrint <= 5.52 - ActiveX GetDriverSettings Remote Exploit ZDI-10-256
    typeremote

Metasploit

descriptionThis module exploits a stack buffer overflow in Novell iPrint Client 5.52. When sending an overly long string to the GetDriverSettings() property of ienipp.ocx an attacker may be able to execute arbitrary code.
idMSF:EXPLOIT/WINDOWS/BROWSER/NOVELLIPRINT_GETDRIVERSETTINGS_2
last seen2020-05-26
modified2017-10-05
published2011-03-06
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/novelliprint_getdriversettings_2.rb
titleNovell iPrint Client ActiveX Control Buffer Overflow

Nessus

NASL familyWindows
NASL idNOVELL_IPRINT_556.NASL
descriptionThe version of Novell iPrint Client installed on the remote host is earlier than 5.56. Such versions are reportedly affected by one or more of the following vulnerabilities that can allow for arbitrary code execution : - The iPrint ActiveX control fails to sanitize input to the
last seen2020-06-01
modified2020-06-02
plugin id51367
published2010-12-29
reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/51367
titleNovell iPrint Client < 5.56 Multiple Vulnerabilities
code
#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(51367);
  script_version("1.14");
  script_cvs_date("Date: 2018/11/15 20:50:27");

  script_cve_id("CVE-2010-4321");
  script_bugtraq_id(44966, 45301);
  script_xref(name:"EDB-ID", value:"16014");

  script_name(english:"Novell iPrint Client < 5.56 Multiple Vulnerabilities");
  script_summary(english:"Checks version of Novell iPrint Client"); 
 
  script_set_attribute(
    attribute:"synopsis",
    value:
"The remote host contains an application that is affected by multiple
vulnerabilities."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The version of Novell iPrint Client installed on the remote host is
earlier than 5.56.  Such versions are reportedly affected by one or
more of the following vulnerabilities that can allow for arbitrary
code execution :

  - The iPrint ActiveX control fails to sanitize input to 
    the 'GetDriverSettings2()' method in the 'ienipp.ocx' 
    component before copying it into a fixed-length buffer 
    on the stack. (ZDI-10-256 / CVE-2010-4321)

  - There is a stack-based buffer overflow in both the
    Netscape (Firefox) and ActiveX (Internet Explorer) 
    plugin components ('npnipp.dll' and 'ienipp.ocx') due to
    their failure to sufficiently validate the size of a
    printer-state-reasons status response. (ZDI-10-295)

  - Buffer overflows exist in both the Netscape (Firefox) 
    and ActiveX (Internet Explorer) plugin components 
    ('npnipp.dll' and 'ienipp.ocx') due to their failure to 
    sufficiently validate the size of an IPP response from 
    a user provided printer-url. (ZDI-10-296 and ZDI-10-299)

  - The 'nipplib.dll component, as used by both types of 
    browser plugins, does not properly handle the value of
    the Location response header in an HTTP 301 response 
    when copying it into a buffer of fixed size.
    (ZDI-10-297)

  - A stack-based buffer overflow exists in the 'npnipp.dll'
    Mozilla browser plugin because it fails to validate a 
    user input to a call-back-url before passing it to a 
    urlencode function and copying the result into a 
    fixed-length buffer. (ZDI-10-298)

  - The 'nipplib.dll component, as used by both types of 
    browser plugins, does not properly handle the value of
    the Connection response header in an HTTP response when
    copying it into a stack-based buffer of fixed size. 
    (ZDI-10-300)"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://www.zerodayinitiative.com/advisories/ZDI-10-256/"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://www.zerodayinitiative.com/advisories/ZDI-10-295/"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://www.zerodayinitiative.com/advisories/ZDI-10-296/"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://www.zerodayinitiative.com/advisories/ZDI-10-297/"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://www.zerodayinitiative.com/advisories/ZDI-10-298/"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://www.zerodayinitiative.com/advisories/ZDI-10-299/"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://www.zerodayinitiative.com/advisories/ZDI-10-300/"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://seclists.org/fulldisclosure/2010/Nov/213"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://seclists.org/fulldisclosure/2010/Dec/642"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://seclists.org/fulldisclosure/2010/Dec/643"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://seclists.org/fulldisclosure/2010/Dec/644"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://seclists.org/fulldisclosure/2010/Dec/645"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://seclists.org/fulldisclosure/2010/Dec/646"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://seclists.org/fulldisclosure/2010/Dec/647"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"http://download.novell.com/Download?buildid=JV7fd0tFHHM~"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Upgrade to Novell iPrint Client 5.56 or later."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Novell iPrint Client ActiveX Control Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2010/11/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/12/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/12/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:novell:iprint");
  script_end_attributes();
 
  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");

  script_dependencies("novell_iprint_532.nasl");
  script_require_keys("SMB/Novell/iPrint/Version");
  script_require_ports(139, 445);

  exit(0);
}


include("global_settings.inc");
include("misc_func.inc");


kb_base = "SMB/Novell/iPrint/";

version = get_kb_item_or_exit(kb_base+"Version");
version_ui = get_kb_item_or_exit(kb_base+"Version_UI");
dll = get_kb_item_or_exit(kb_base+"DLL");

fixed_version = "5.5.6.0";
fixed_version_ui = "5.56";

if (ver_compare(ver:version, fix:fixed_version) == -1)
{
  if (report_verbosity > 0)
  {
    path = get_kb_item(kb_base+"Path");
    if (isnull(path)) path = 'n/a';

    report =
      '\n  File              : '+dll+
      '\n  Installed version : '+version_ui+
      '\n  Fixed version     : '+fixed_version_ui+'\n';
    security_hole(port:get_kb_item("SMB/transport"), extra:report);
  }
  else security_hole(get_kb_item("SMB/transport"));
}
else exit(0, "The host is not affected since Novell iPrint Client "+version_ui+" is installed.");

Packetstorm

Saint

bid44966
descriptionNovell iPrint Client ActiveX Control GetDriverSettings buffer overflow
osvdb69357
titlenovell_iprint_activex_getdriversettings
typeclient

References