CVE-2008-4479
Novell eDirectory dhost.exe Accept Language Header Heap Overflow Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.8 before 8.8.3, and 8.7.3 before 8.7.3.10 ftf1, allows remote attackers to execute arbitrary code via a SOAP request with a long Accept-Language header.
Desbordamiento de búfer basado en montículo en dhost.exe de Novell eDirectory 8.8 anterior a 8.8.3 y 8.7.3 antes de 8.7.3.10 ftf1, permite a atacantes remotos ejecutar código de su elección mediante una petición SOAP con una cabecera Accept-Language larga.
This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Novell eDirectory. Authentication is not required to exploit this vulnerability.
The specific flaw resides in the web console running on TCP ports 8028 and 8030. The server exposes a web interface and accepts SOAP connections. The service copies the contents of the Accept-Language header within a SOAP request into a fixed-length buffer without any bounds checking. If an attacker sends a specially crafted request it will trigger an overflow during a memory copy operation leading to arbitrary code execution under the context of the SYSTEM user.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2008-10-07 CVE Reserved
- 2008-10-08 CVE Published
- 2023-04-14 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/32111 | Third Party Advisory | |
| http://securityreason.com/securityalert/4405 | Third Party Advisory | |
| http://www.securityfocus.com/archive/1/497164/100/0/threaded | Mailing List | |
| http://www.securitytracker.com/id?1020989 | Third Party Advisory | |
| http://www.vupen.com/english/advisories/2008/2738 | Third Party Advisory | |
| http://www.zerodayinitiative.com/advisories/ZDI-08-064 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Novell Search vendor "Novell" | Edirectory Search vendor "Novell" for product "Edirectory" | >= 8.7.3 < 8.7.3.10 Search vendor "Novell" for product "Edirectory" and version " >= 8.7.3 < 8.7.3.10" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Edirectory Search vendor "Novell" for product "Edirectory" | >= 8.8 < 8.8.3 Search vendor "Novell" for product "Edirectory" and version " >= 8.8 < 8.8.3" | - |
Affected
| ||||||