high7.5Public exploit code
CVE-2006-5478
Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow remote a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Novell eDirectory 8.x - iMonitor HTTPSTK Buffer Overflow (3)2006-10-30 · remote · novell · Verified
- Novell eDirectory 8.x - iMonitor HTTPSTK Buffer Overflow (2)2006-10-30 · remote · novell · Verified
- Novell eDirectory 8.x - iMonitor HTTPSTK Buffer Overflow (1)2006-10-21 · remote · novell · Verified
- Novell eDirectory NDS Server - Host Header Overflow (Metasploit)2010-05-09 · remote · windows · Verified
Impact
Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow remote attackers to execute arbitrary code via (1) a long HTTP Host header, which triggers an overflow in the BuildRedirectURL function; or vectors related to a username containing a . (dot) character in the (2) SMTP, (3) POP, (4) IMAP, (5) HTTP, or (6) Networked Messaging Application Protocol (NMAP) Netmail services.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Novell | Edirectory | Versions 8.0, 8.5, 8.5.12a, 8.5.27, 8.6.2, 8.7 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050382.html
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050388.html
- http://secunia.com/advisories/22519
- http://securitytracker.com/id?1017125
- http://securitytracker.com/id?1017141
- http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974600.htm
- http://www.mnin.org/advisories/2006_novell_httpstk.pdf
- http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=3723994&sliceId=SAL_Public&dialogID=16776123&stateId=1%200%202648401
- http://www.securityfocus.com/archive/1/449899/100/0/threaded
- http://www.securityfocus.com/archive/1/450017/100/0/threaded
- http://www.securityfocus.com/archive/1/450520/100/100/threaded
- http://www.securityfocus.com/bid/20655
- http://www.securityfocus.com/bid/20853
- http://www.vupen.com/english/advisories/2006/4141
- http://www.zerodayinitiative.com/advisories/ZDI-06-035.html
- http://www.zerodayinitiative.com/advisories/ZDI-06-036.html
- https://secure-support.novell.com/KanisaPlatform/Publishing/134/3096026_f.SAL_Public.html
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050382.html
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050388.html
- http://secunia.com/advisories/22519
- http://securitytracker.com/id?1017125
- http://securitytracker.com/id?1017141
- http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974600.htm
- http://www.mnin.org/advisories/2006_novell_httpstk.pdf
- http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=3723994&sliceId=SAL_Public&dialogID=16776123&stateId=1%200%202648401