[NT] Novell eDirectory Multiple Vulnerabilities (dhost.exe)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Novell eDirectory Multiple Vulnerabilities (dhost.exe)
------------------------------------------------------------------------


SUMMARY

Multiple vulnerabilities have been discovered in Novell's eDirectory's
dhost.exe service, these vulnerabilities would allow an attacker to
overflow internal buffers used by the product which can be then leveraged
to cause the execution of arbitrary code.

DETAILS

Novell eDirectory Core Protocol Opcode 0x24 Heap Overflow Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Novell eDirectory Server. Authentication is
not required to exploit this vulnerability.

The specific flaw exists within dhost.exe, the service responsible for
directory replication which is bound by default to TCP port 524. Improper
parsing within opcode 0x24 via the Netware Core Protocol can result in an
arithmetic calculation based on supplied user-input resulting in an
under-allocated heap buffer. This fault can be leveraged to result in
arbitrary code execution.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4480>
CVE-2008-4480

Vendor Response:
Novell has issued an update to correct this vulnerability. More details
can be found at:

<http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7001183&sliceId=1&docTypeID=DT_TID_1_1&dialogID=78066829&stateId=0%200%2078062953> http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7001183&sliceId=1&docTypeID=DT_TID_1_1&dialogID=78066829&stateId=0%200%2078062953


Novell eDirectory Core Protocol Opcode 0x0F Heap Overflow Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Novell eDirectory Server. Authentication is
not required to exploit this vulnerability.

The specific flaw exists within dhost.exe, the service responsible for
directory replication which is bound by default to TCP port 524. Improper
parsing within opcode 0x0F via the Netware Core Protocol can result in an
arithmetic calculation based on supplied user-input resulting in an
integer overflow that will be used to copy into a heap buffer. This fault
can be leveraged to result in arbitrary code execution.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4478>
CVE-2008-4478

Vendor Response:
Novell has issued an update to correct this vulnerability. More details
can be found at:

<http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7001184&sliceId=1&docTypeID=DT_TID_1_1&dialogID=78066829&stateId=0%200%2078062953> http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7001184&sliceId=1&docTypeID=DT_TID_1_1&dialogID=78066829&stateId=0%200%2078062953


Novell eDirectory dhost.exe Accept Language Header Heap Overflow
Vulnerability
This vulnerability allows attackers to execute arbitrary code on
vulnerable installations of Novell eDirectory. Authentication is not
required to exploit this vulnerability.

The specific flaw resides in the web console running on TCP ports 8028 and
8030. The server exposes a web interface and accepts SOAP connections. The
service copies the contents of the Accept-Language header within a SOAP
request into a fixed-length buffer without any bounds checking. If an
attacker sends a specially crafted request it will trigger an overflow
during a memory copy operation leading to arbitrary code execution under
the context of the SYSTEM user.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4479>
CVE-2008-4479

Vendor Response:
Novell has issued an update to correct this vulnerability. More details
can be found at:

<http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7000086&sliceId=1&docTypeID=DT_TID_1_1&dialogID=78066829&stateId=0%200%2078062953> http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7000086&sliceId=1&docTypeID=DT_TID_1_1&dialogID=78066829&stateId=0%200%2078062953


Novell eDirectory dhost.exe Content-Length Header Heap Overflow
Vulnerability
This vulnerability allows attackers to execute arbitrary code on
vulnerable installations of Novell eDirectory. Authentication is not
required to exploit this vulnerability.

The specific flaw resides in the web console running on TCP ports 8028 and
8030. The server exposes a web interface and accepts SOAP connections.
While parsing the Content-Length header within a SOAP request an integer
overflow can occur. This integer overflow triggers a subsequent overflow
during a memory copy operation leading to arbitrary code execution under
the context of the SYSTEM user.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4478>
CVE-2008-4478

Vendor Response:
Novell has issued an update to correct this vulnerability. More details
can be found at:

<http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7000087&sliceId=1&docTypeID=DT_TID_1_1&dialogID=78066829&stateId=0%200%2078062953> http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7000087&sliceId=1&docTypeID=DT_TID_1_1&dialogID=78066829&stateId=0%200%2078062953


ADDITIONAL INFORMATION

The information has been provided by Zero Day Initiative (ZDI).
The original article can be found at:
<http://www.zerodayinitiative.com/advisories/ZDI-08-063>
http://www.zerodayinitiative.com/advisories/ZDI-08-063,
<http://www.zerodayinitiative.com/advisories/ZDI-08-064>
http://www.zerodayinitiative.com/advisories/ZDI-08-064,
<http://www.zerodayinitiative.com/advisories/ZDI-08-065>
http://www.zerodayinitiative.com/advisories/ZDI-08-065 and
<http://www.zerodayinitiative.com/advisories/ZDI-08-066>
http://www.zerodayinitiative.com/advisories/ZDI-08-066



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Winamp ID3v2 Buffer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Winamp is vulnerable to a buffer overflow vulnerability when processing ... control the EAX register, ...
    (Securiteam)
  • [UNIX] Novell eDirectory LDAP Search Request Heap Corruption Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Novell eDirectory LDAP Search Request Heap Corruption Vulnerability ...
    (Securiteam)
  • [NEWS] Novell eDirectory dhost Integer Overflow Code Execution Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Novell eDirectory dhost Integer Overflow Code Execution Vulnerability ...
    (Securiteam)
  • [NT] Citrix Program Neighborhood Name Heap Corruption
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Citrix Program Neighborhood Name Heap Corruption ... Exploitation of a heap overflow vulnerability in Citrix, ...
    (Securiteam)
  • [NEWS] Novell eDirectory Unauthenticated Access to SOAP Interface
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Novell eDirectory Unauthenticated Access to SOAP Interface ... This vulnerability isn't patched in 8.7.3 SP 10. ... prevent the EMBOX module from loading. ...
    (Securiteam)