HTTP: Novell eDirectory dhost URI Parsing Buffer Overflow

This signature detects attempts to exploit a known vulnerability in Novell eDirectory. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the targeted application.

Extended Description

Stack-based buffer overflow in the dhost module in Novell eDirectory 8.8 SP5 for Windows allows remote authenticated users to cause a denial of service (dhost.exe crash) and possibly execute arbitrary code via a long string to /dhost/modules?I:.

References

BugTraq: 36815

CVE: CVE-2009-4653

URL: http://tcc.hellcode.net/advisories/hellcode-adv004.txt

Short Name

HTTP:NOVELL:DHOST-URI-BOF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Novell eDirectory dhost URI Parsing Buffer Overflow

Extended Description

References

Found a potential security threat?