Security Vulnerability: Novell eDirectory Heap-based Buffer Overflow

Novell eDirectory permits unauthenticated users to query the server for information about specific objects.  The user can send a service request (NDS Verb 0x1) that has integer used in a memory allocation. A large integer can result in an integer wrap and a subsequent allocation returning an insufficient buffer, resulting in a heap-based buffer overflow.

Successful exploitation would grant an attacker the same privileges eDirectory is using and/or cause a crash of the eDirectory service resulting in a denial of service.

This vulnerability is resolved by applying the following:

For eDirectory 8.7.3.X, apply eDirectory 8.7.3.10 ftf2 or newer.
For eDirectory 8.8.X, apply eDirectory 8.8.5.2 or newer.

Patches are available at https://dl.netiq.com

This vulnerability was discovered and researched by Chris Valasek and John McDonald of the IBM X-Force.

http://www.iss.net/threats/356.html

CVE-2009-0895