Novell Patches Vulnerability in eDirectory Product

Novell has fixed a vulnerability in its eDirectory service that could affect users who run the program on some Linux and WIndows platforms. The problem, a stack buffer overflow CVE-2012-0432 is remotely exploitable and can be done without authentication, according to an alert issued yesterday by...

Novell eDirectory 8.8.x Multiple Security Vulnerabilities

The remote host is running eDirectory, a directory service software from Novell. The installed version of Novell eDirectory is affected by multiple issues : - An unspecified cross-site scripting flaw exists. CVE-2012-0428 - It is possible to trigger a remote denial of service vulnerability by...

CVE-2012-0428

Cross-site scripting XSS vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-0432

Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors...

CVE-2012-0430

Unspecified vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote attackers to obtain an administrator cookie and bypass authorization checks via unknown vectors...

CVE-2012-0429

dhost in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote authenticated users to cause a denial of service daemon crash via crafted characters in an HTTP request...

Cross site scripting

Cross-site scripting XSS vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Authorization

Unspecified vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote attackers to obtain an administrator cookie and bypass authorization checks via unknown vectors...

Stack overflow

Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors...

Cross site request forgery (csrf)

dhost in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote authenticated users to cause a denial of service daemon crash via crafted characters in an HTTP request...

CVE-2012-0428

CVE-2012-0428 affects NetIQ eDirectory 8.8.x: a Cross-site Scripting (XSS) vulnerability in the web interface allows remote attackers to inject arbitrary script/HTML via unspecified vectors. The vulnerability exists in 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2, with the impact on the user...

CVE-2012-0429

CVE-2012-0429 affects NetIQ/Novell eDirectory 8.8.6.x (before 8.8.6.7) and 8.8.7.x (before 8.8.7.2) on Windows. The vulnerability is in the dhost component where crafted characters in an HTTP request allow remote authenticated users to trigger a denial of service (daemon crash). Impact as reporte...

CVE-2012-0432

Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors...

CVE-2012-0432

CVE-2012-0432 describes a stack-based buffer overflow in the NetIQ eDirectory (Novell eDirectory) NCP stack (ndsd) for version 8.8.7.x prior to 8.8.7.2. The root cause is improper bounds checking in the NCP handling (KeyedObjectLogin path), enabling remote attackers to cause a likely remote code ...

CVE-2012-0430

CVE-2012-0430 affects NetIQ eDirectory 8.8.6.x (before 8.8.6.7) and 8.8.7.x (before 8.8.7.2) on Windows. The vulnerability allows remote attackers to obtain an administrator cookie and bypass authorization checks via unknown vectors. Multiple connected sources corroborate this CVE as part of a se...

CVE-2012-0428

Cross-site scripting XSS vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-0429

dhost in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote authenticated users to cause a denial of service daemon crash via crafted characters in an HTTP request...

CVE-2012-0430

Unspecified vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote attackers to obtain an administrator cookie and bypass authorization checks via unknown vectors...

Novell eDirectory dhost服务/NCP实现内多个安全漏洞

BUGTRAQ ID: 57038 CVECAN ID: CVE-2012-0428,CVE-2012-0429,CVE-2012-0430,CVE-2012-0432 Novell eDirectory是一个跨平台的目录服务器。 Novell eDirectory 8.8.7.2、8.8.6.7之前版本存在跨站脚本、拒绝服务、信息泄露、栈缓冲区溢出漏洞，利用这些漏洞，攻击者可在受影响浏览器中执行任意脚本代码、窃取cookie、泄露敏感信息、执行任意代码、造成拒绝服务。 1）在处理某些字符时，dhost服务内存在错误，可被利用通过特制的HTTP请求造成拒绝服务。此漏洞仅影响Windwos...

Novell eDirectory Multiple Buffer Overflow Vulnerabilities (CVE-2006-5478) - Active Check

Novell eDirectory is prone to multiple multiple stack based buffer overflow vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CP...