Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2008-5038

Overview

Vulnerability Score 10.0 10.0
CVE Id CVE-2008-5038
Last Modified 10 Mar 2011 12:00:00
Published 12 Nov 2008 04:09:03
Confidentiality Impact COMPLETE COMPLETE
Integrity Impact COMPLETE COMPLETE
Availability Impact COMPLETE COMPLETE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2008-5038

Summary

Use-after-free vulnerability in the NetWare Core Protocol (NCP) feature in Novell eDirectory 8.7.3 SP10 before 8.7.3 SP10 FTF1 and 8.8 SP2 for Windows allows remote attackers to cause a denial of service and possibly execute arbitrary code via a sequence of "Get NCP Extension Information By Name" requests that cause one thread to operate on memory after it has been freed in another thread, which triggers memory corruption, aka Novell Bug 373852.

Vulnerable Systems

Application

  • Novell Edirectory 8.0

  • Novell Edirectory 8.5

  • Novell Edirectory 8.5.12a

  • Novell Edirectory 8.5.27

  • Novell Edirectory 8.6.2

  • Novell Edirectory 8.7

  • Novell Edirectory 8.7.1

  • Novell Edirectory 8.7.3

  • Novell Edirectory 8.8


References

CONFIRM - http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037181.html

CONFIRM - http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037180.html

XF - novell-edirectory-ncp-unspecified(46138)

VUPEN - ADV-2008-2937

SECTRACK - 1021117

BID - 31956

CONFIRM - http://www.novell.com/support/viewContent.do?externalId=3426981

SECUNIA - 32395

OSVDB - 48206

IDEFENSE - 20081030 Novell eDirectory NCP Get Extension Information Request Memory Corruption Vulnerability


Last Updated: 27 May 2016 10:48:41