|
|
|
|
| |
Credit:
The information has been provided by iDefense.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=724
|
| |
Vulnerable Systems:
* Novell eDirectory version 8.8 SP2 for Linux
Immune Systems:
* Novell eDirectory version 8.8 SP2 FTF2 (8.8.2)
* Novell eDirectory version 8.7.3 SP10b
The vulnerability exists due to an incorrect calculation when allocating a heap buffer to store the search parameters. By passing NULL search parameters, it is possible to overflow a heap based buffer with the string "(null)". This can result in the corruption of heap management structures, and depending on the layout of the heap, possibly function pointers.
Analysis:
Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the affected service, usually root. Since the data that overflows the buffer is not controlled by the attacker, exploitation is non-trivial.
Workaround:
It is possible to disable the LDAP service from running via the ndsmodules.conf file which is usually located in /etc/opt/novell/eDirectory/conf. However, doing so greatly reduces the functionality of this software.
Vendor response:
Novell Inc. has addressed this vulnerability with the release of FTF2 for eDirectory 8.8 SP2 (8.8.2) and SP10b for eDirectory 8.7.3. For more information visit the following URL.
http://www.novell.com/support/viewContent.do?externalId=3843876
CVE Information:
CVE-2008-1809
Disclosure Timeline:
03/10/2008 - Initial vendor notification
03/13/2008 - Initial vendor response
07/09/2008 - Coordinated public disclosure
|
|
|
|
|
