HTTP: Novell eDirectory SOAP Handling Accept Language Header Heap Overflow

This signature detects attempts to exploit a known buffer overflow vulnerability in Novell eDirectory. It is due to boundary error when processing SOAP-HTTP requests. By supplying overly large data to the Accept-Language header, a remote unauthenticated attacker can leverage this vulnerability to inject and execute arbitrary code on the target host with System or root level privileges. An attack targeting this can result in the injection and execution of arbitrary code. If code execution is successful, the behavior of the target depends on the intention of the attacker. Any injected code is executed within the system or root privileges. In an unsuccessful code execution attack, eDirectory Web console might terminate abnormally.

Extended Description

Novell eDirectory is prone to multiple buffer-overflow vulnerabilities. Successful exploits may allow attackers to execute arbitrary code within the context of the affected application or to cause denial-of-service conditions. These issues affect eDirectory 8.7.3 SP10 prior to 8.7.3 SP10 FTF1.

Affected Products

Novell edirectory

References

BugTraq: 31553

CVE: CVE-2008-4479

Short Name

HTTP:NOVELL:EDIRECTORY-SOAP

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Novell eDirectory SOAP Handling Accept Language Header Heap Overflow

Extended Description

Affected Products

References

Found a potential security threat?