CVE-2006-0992
Novell GroupWise Messenger Accept-Language Buffer Overflow Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Stack-based buffer overflow in Novell GroupWise Messenger before 2.0 Public Beta 2 allows remote attackers to execute arbitrary code via a long Accept-Language value without a comma or semicolon. NOTE: due to a typo, the original ZDI advisory accidentally referenced CVE-2006-0092. This is the correct identifier.
This vulnerability allows attackers to execute arbitrary code on vulnerable installations of the Novell GroupWise Messenger. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the Novell Messaging Agent, a web server that listens by default on TCP port 8300. Insufficient length checks during the parsing of long parameters within the Accept-Language header results in an exploitable stack overflow under the context of the SYSTEM user.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2006-03-03 CVE Reserved
- 2006-04-13 CVE Published
- 2010-09-20 First Exploit
- 2024-08-03 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (14)
| URL | Tag | Source |
|---|---|---|
| http://cirt.dk/advisories/cirt-42-advisory.txt | X_refsource_misc | |
| http://metasploit.blogspot.com/2006/04/exploit-development-groupwise_14.html | X_refsource_misc | |
| http://secunia.com/advisories/19663 | Third Party Advisory | |
| http://securitytracker.com/id?1015911 | Vdb Entry | |
| http://www.osvdb.org/24617 | Vdb Entry | |
| http://www.securityfocus.com/archive/1/430911/100/0/threaded | Mailing List | |
| http://www.vupen.com/english/advisories/2006/1355 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25828 | Vdb Entry | |
| - |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/16757 | 2010-09-20 | |
| https://www.exploit-db.com/exploits/1679 | 2024-08-07 |
| URL | Date | SRC |
|---|---|---|
| http://support.novell.com/cgi-bin/search/searchtid.cgi?10100861.htm | 2018-10-18 | |
| http://www.securityfocus.com/bid/17503 | 2018-10-18 | |
| http://www.zerodayinitiative.com/advisories/ZDI-06-008.html | 2018-10-18 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Novell Search vendor "Novell" | Groupwise Messenger Search vendor "Novell" for product "Groupwise Messenger" | 2.0 Search vendor "Novell" for product "Groupwise Messenger" and version "2.0" | - |
Affected
| ||||||