Title: Novell Client 'nwspool.dll' EnumPrinters RPC Request Buffer Overflow Vulnerability
Severity: CRITICAL
Description:
Novell Client is a workstation application to enable access to Novell NetWare network services.
Novell Client is prone to a buffer-overflow vulnerability. This issue stems from a logical flaw that allows attackers to bypass a previous patch. This issue occurs in the 'NWSPOOL.DLL 2' library, which exposes the 'EnumPrinters()' function.
A remote attacker may exploit this issue to execute arbitrary code with SYSTEM-level privileges, facilitating the compromise of affected computers. Failed exploit attempts will likely crash the application, denying service to legitimate users.
NOTE: This issue may have been caused by an incomplete patch for the vulnerability documented in BID 25092 ('Novell Client NWSPOOL.DLL Unspecified Buffer Overflow Vulnerability').
Novell Client 4.91 SP2 through SP4 are vulnerable; other versions may also be affected.
Affected Products:
- Novell Client 4.91 SP2
- Novell Client 4.91 SP3
- Novell Client 4.91 SP4
References:
- Novell: 5008300 Novell Client 4.91 Post-SP2/3/4 NWSPOOL.DLL 2
- Novell: Novell Home Page
- Zero Day Initiative: ZDI-08-005 Novell Client NWSPOOL.DLL EnumPrinters Stack Overflow Vulnerability
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
