Novell eDirectory iMonitor vulnerable to buffer overflow

Overview

Novell eDirectory iMonitor contains a buffer overflow that can be remotely exploited to allow execution of arbitrary code or crash an affected system.

Description

Novell eDirectory iMonitor is a service for monitoring servers in an eDirectory installation. A buffer overflow exists in Novell eDirectory version 8.7.3 iMonitor for Microsoft Windows 2000, 2003, and NT. A stack-based buffer within the iMonitor can be overwritten via a specially-crafted HTTP request. To exploit this vulnerability an attacker must have access to iMonitor which is installed on systems that are part of a Novell eDirectory tree.

Note that exploits for this vulnerability have been made available on public web sites.

---

Impact

A remote attacker with access to a system in a Novell eDirectory tree may be able to crash an affected system or execute arbitrary code with the privileges of the iMonitor service, typically SYSTEM on Microsoft Windows.

---

Solution

Apply a patch
Novell has released the patch (edir873ptf_imon1.exe) to correct this issue.

---

Restrict access

To limit your exposure to attacks you may wish to block access to Novell iMonitor from outside your network perimeter. However, blocking at the network perimeter would still allow attackers within the perimeter of your network to exploit the vulnerability. The use of host-based firewalls in addition to network-based firewalls can help restrict access to specific hosts within the network. It is important to understand your network’s configuration and service requirements before deciding what changes are appropriate.

---

Vendor Information

213165

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Novell __ Affected

Updated: August 22, 2005

Status

Affected

Vendor Statement

Information about this vulnerability may be found at the vendor’s site:

<http://support.novell.com/cgi-bin/search/searchtid.cgi?/10098568.htm&gt;

This fix should be applied to eDirectory 8.7.3 IR4 or 8.7.3 IR6. The fix will be included in IR7.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://support.novell.com/cgi-bin/search/searchtid.cgi?/10098568.htm&gt;

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23213165 Feedback>).

CVSS Metrics

Group	Score	Vector
Base	0	AV:–/AC:–/Au:–/C:–/I:–/A:–
Temporal	0	E:ND/RL:ND/RC:ND
Environmental	0	CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

• <http://support.novell.com/cgi-bin/search/searchtid.cgi?/10098568.htm&gt;
• <http://support.novell.com/cgi-bin/search/searchtid.cgi?/2972038.htm&gt;
• <http://support.novell.com/servlet/filedownload/sec/pub/edir873ptf_imon1.exe&gt;
• <http://secunia.com/advisories/16393/&gt;
• <http://online.securityfocus.com/bid/14548&gt;

Acknowledgements

This vulnerability was reported by Peter Winter-Smith of NGSSoftware Insight Security Research.

This document was written by Jeff Gennari.

Other Information

CVE IDs:	CVE-2005-2551
Severity Metric:	16.54 Date Public: