|
|
|
|
| |
Credit:
The information has been provided by iDefense.
The original article can be found at:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=436
|
| |
Vulnerable Systems:
* Novell iManager version 2.5.
The vulnerability specifically exists due to improper handling of a an HTTP POST request with a long TREE parameter. When such a request is received, a NULL pointer dereference occurs, leading to a crash of the service. iDefense Labs testing has indicated that any string longer than 256 bytes will be effective.
Exploitation requires that an attacker send a specially constructed HTTP request to the server. This crashes the server, making it unusable until it is restarted.
Vendor Status:
Novell has addressed this vulnerability within iManager version 2.6. Upgrading to this version will alleviate exposure to the vulnerability.
CVE Information:
CVE-2006-4517
Disclosure Timeline:
* 08/17/2006 - Initial vendor notification
* 08/18/2006 - Initial vendor response
* 10/06/2006 - Second vendor notification
* 10/31/2006 - Coordinated public disclosure
|
|
|
|
|
