Title: Novell NetWare Distributed Print Services Integer Overflow Vulnerability
Severity: CRITICAL
Description:
Novell Netware Distributed Print Services (NDPS/iPrint) is a communications layer for printer management. It is also available as a plugin module for iManager as iPrint.
Novell NetWare Distributed Print Services is prone to an integer-overflow vulnerability. This issue occurs due to the multiplication of the number and size of elements passed to the 'ndps_xdr_array()' function. If the multiplication results in an integer-overflow, a memory allocation will result in a smaller-than-expected amount of memory; subsequent copy operations may overwrite data past the end of this newly allocated region.
The vulnerable function is used in numerous places in the software, giving attackers many potential avenues of attack.
An attacker could exploit this vulnerability to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely cause denial-of-service conditions. Since the vulnerable application executes with administrative privileges, this may facilitate the complete remote compromise of affected computers.
Affected Products:
- Novell Client 4.83 SP3
- Novell Client 4.90 SP2
- Novell Client 4.91
- Novell Client 4.91 SP1
- Novell Client 4.91 SP2
- Novell Netware 6.5.0
- Novell Netware 6.5.0 SP1
- Novell Netware 6.5.0 SP1.1(a)
- Novell Netware 6.5.0 SP1.1(b)
- Novell Netware 6.5.0 SP2
- Novell Netware 6.5.0 SP3
- Novell Netware 6.5.0 SP4
- Novell Netware 6.5.0 SP5
- Novell Open Enterprise Server (OES)
References:
- Novell: NDPS client remote integer overflow vulnerability
- Novell: NDPS on NetWare remote integer overflow vulnerability
- Novell: TID2973700 - Security release for DPRPCNLM
- Novell: TID2973719 - ovell Client 4.91 Post-SP2 DPRPCW32.DLL
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
