Advisory Details

October 26th, 2006

Novell eDirectory NDS Server Host Header Buffer Overflow Vulnerability

ZDI-06-035
ZDI-CAN-081

CVE ID CVE-2006-5478
CVSS SCORE
AFFECTED VENDORS Novell
AFFECTED PRODUCTS eDirectory
TREND MICRO CUSTOMER PROTECTION Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 4519. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell eDirectory. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the httpstk.dll library within the dhost.exe web interface of the eDirectory Host Environment. The web interface does not validate the length of the HTTP Host header prior to using the value of that header in an HTTP redirect. This results in an exploitable stack-based buffer overflow.

ADDITIONAL DETAILS Novell has issued an update to correct this vulnerability. More details can be found at:
Novell TID #3723994
DISCLOSURE TIMELINE
  • 2006-08-14 - Vulnerability reported to vendor
  • 2006-10-26 - Coordinated public release of advisory
CREDIT Manuel Santamarina Suarez
BACK TO ADVISORIES