Vulnerability Name:

CVE-2009-0192 (CCN-51703)

Assigned:2009-07-14
Published:2009-07-14
Updated:2018-10-11
Summary:Off-by-one error in the iMonitor component in Novell eDirectory 8.8 SP3, 8.8 SP3 FTF3, and possibly other versions allows remote attackers to execute arbitrary code via an HTTP request with a crafted Accept-Language header, which triggers a stack-based buffer overflow.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-189
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2009-0192

Source: OSVDB
Type: UNKNOWN
55847

Source: CCN
Type: SA34160
Novell eDirectory Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
34160

Source: CCN
Type: Secunia Research 14/07/2009
Novell eDirectory iMonitor "Accept-Language" Buffer Overflow

Source: MISC
Type: Vendor Advisory
http://secunia.com/secunia_research/2009-13/

Source: CCN
Type: Novell Document ID: 3426981
History of Issues Resolved in eDirectory 8.8.x

Source: CONFIRM
Type: UNKNOWN
http://www.novell.com/support/viewContent.do?externalId=3426981

Source: CCN
Type: OSVDB ID: 55847
Novell eDirectory iMonitor HTTP Request Handling Off-by-one Remote DoS

Source: BUGTRAQ
Type: UNKNOWN
20090714 Secunia Research: Novell eDirectory iMonitor "Accept-Language" Buffer Overflow

Source: BID
Type: UNKNOWN
35666

Source: CCN
Type: BID-35666
Novell eDirectory Multiple Vulnerabilities

Source: VUPEN
Type: Vendor Advisory
ADV-2009-1883

Source: XF
Type: UNKNOWN
edirectory-imonitor-acceptlanguage-bo(51703)

Source: XF
Type: UNKNOWN
edirectory-imonitor-acceptlanguage-bo(51703)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:novell:edirectory:8.8:sp3:*:*:*:*:*:*
  • OR cpe:/a:novell:edirectory:8.8:sp3:ftf3:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:novell:edirectory:8.8:sp3:*:*:*:*:*:*
  • OR cpe:/a:novell:edirectory:8.8:sp3:ftf3:*:*:*:*:*

  • * Denotes that component is vulnerable
    BACK
    novell edirectory 8.8 sp3
    novell edirectory 8.8 sp3
    novell edirectory 8.8 sp3
    novell edirectory 8.8 sp3