Novell eDirectory dhost Integer Overflow Code Execution Vulnerability

July 10th, 2008
ZDI-08-041 ZDI-CAN-276

CVE ID

CVE-2008-3159

CVSS Score

None None

Affected Vendors

Novell

Affected Products

eDirectory

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell eDirectory. Authentication is not required to exploit this vulnerability.

The specific flaw exists within dhost.exe, bound by default to TCP port 524. Flawed arithmetic applied to a user-supplied value results in an integer overflow and subsequently a complete stack smash allowing an attacker to execute arbitrary code via SEH redirection.

Additional Details

Novell has issued an update to correct this vulnerability. More details can be found at:
http://www.novell.com/support/search.do?cmd=displayKC&sliceId=SAL_Public&externalId=3694858

Disclosure Timeline

  • 2007-12-04 - Vulnerability reported to vendor
  • 2008-07-10 - Coordinated public release of advisory

Credit

Sebastian Apelt (webmaster@buzzworld.org)

Back to Advisories