Novell eDirectory < 8.7.3 SP 10 / 8.8.2 - HTTP headers Denial of Service

= Affected software : Editor : Novell Name : eDirectory Version : 8.7.3 SP 10 and 8.8.2 Services : TCP/8028 HTTP and TCP/8030 HTTPS = External references : http://www.novell.com/support/viewContent.do?externalId=3829452&sliceId=1 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0927 =...

Novell eDirectory Host Environment Service (dhost.exe) HTTP Connection Header DoS

The remote host is running eDirectory, a directory service software from Novell. The installed version of eDirectory is affected by a denial of service issue. By sending an HTTP request with a specially crafted 'Connection' header to the server, an unauthenticated attacker may be able to trigger ...

Novell eDirectory HTTP Connection头拒绝服务漏洞

BUGTRAQ ID: 28757 CVECAN ID: CVE-2008-0927 Novell eDirectory是一个的跨平台的目录服务器。 Novell eDirectory的dhost.exe服务在处理HTTP请求中的Connection头时存在漏洞，如果远程攻击者向该服务发送了多个特制的HTTP请求的话，就可能导致耗尽大量CPU资源。 Novell eDirectory = 8.8.1 Novell eDirectory = 8.7.3.9 Novell ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Novell eDirectory Host Environment服务HTTP请求远程拒绝服务漏洞

BUGTRAQ ID: 28572 Novell eDirectory是一个的跨平台的目录服务器。 Novell eDirectory的Host Environment服务（dhost.exe）没有正确地处理HTTP请求。如果远程攻击者向该服务的默认8028/TCP端口发送了超长的HTTP请求的话，就会导致服务耗尽大量CPU资源，停止响应其他请求。 Novell eDirectory 8.8.2 Novell ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

CVE-2008-0927

dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service CPU consumption via an HTTP request with 1 multiple Connection headers or 2 a Connection header with multiple comma-separated values. NOTE: this might be similar to CVE-2008-1777...

Code injection

dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service CPU consumption via an HTTP request with 1 multiple Connection headers or 2 a Connection header with multiple comma-separated values. NOTE: this might be similar to CVE-2008-1777...

Design/Logic Flaw

The eDirectory Host Environment service dhost.exe in Novell eDirectory 8.8.2 allows remote attackers to cause a denial of service CPU consumption via a long HTTP HEAD request to TCP port 8028...

CVE-2008-1777

The eDirectory Host Environment service dhost.exe in Novell eDirectory 8.8.2 allows remote attackers to cause a denial of service CPU consumption via a long HTTP HEAD request to TCP port 8028...

CVE-2008-0927

dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service CPU consumption via an HTTP request with 1 multiple Connection headers or 2 a Connection header with multiple comma-separated values. NOTE: this might be similar to CVE-2008-1777...

CVE-2008-1777

The CVE-2008-1777 entry concerns the eDirectory Host Environment service (dhost.exe) in Novell eDirectory. Affected version shown in sources is eDirectory 8.8.2, where a remote attacker can cause a denial of service (CPU consumption) by sending a long HTTP HEAD request to TCP port 8028. Related r...

CVE-2008-1777

The eDirectory Host Environment service dhost.exe in Novell eDirectory 8.8.2 allows remote attackers to cause a denial of service CPU consumption via a long HTTP HEAD request to TCP port 8028...

CVE-2008-0927

The CVE-2008-0927 issue is in dhost.exe of Novell eDirectory. Affected products are eDirectory versions before SP10 of 8.7.3 and before 8.8.2, where the dhost.exe process can be forced to consume 100% CPU (DoS) by certain HTTP requests that abuse Connection headers (either multiple Connection hea...

Novell eDirectory eMBox Utility Unauthorized Access

The remote host is running eDirectory, a popular directory service software from Novell. A vulnerability in the eMBox utility included with the software, may allow an unauthenticated attacker to access local files or cause a denial of service condition. C Tenable Network Security, Inc...

Novell eDirectory eMBox Utility Unauthorized Access (uncredentialed check)

The remote host is running eDirectory, a popular directory service software from Novell. A vulnerability in the eMBox utility included with the software allows an unauthenticated attacker to access local files or cause a denial of service condition. Nessus was able to query the list of available...

Novel eDirectory HTTP Denial of Service Exploit

No description provided by source. !/usr/bin/python Novel eDirectory HTTP DOS Discovered and coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/novel-edir.py.txt import socket import os import sys from time import sleep biff=""2048 print " Payload sent "...

novell-dos.txt

!/usr/bin/python Novel eDirectory HTTP DOS Discovered and coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/novel-edir.py.txt import socket import os import sys from time import sleep biff=""2048 print " Payload sent "+ strlenbuff expl = socket.socket...

Novel eDirectory HTTP Denial of Service Exploit

Exploit for unknown platform in category dos / poc =============================================== Novel eDirectory HTTP Denial of Service Exploit =============================================== !/usr/bin/python Novel eDirectory HTTP DOS Discovered and coded by Mati Aharoni...

Novel eDirectory HTTP - Denial of Service

Novel eDirectory HTTP - Denial of Service !/usr/bin/python Novel eDirectory HTTP DOS Discovered and coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/novel-edir.py.txt import socket import os import sys from time import sleep biff=""2048 print " Payload...

Novel eDirectory HTTP - Denial of Service

!/usr/bin/python Novel eDirectory HTTP DOS Discovered and coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/novel-edir.py.txt import socket import os import sys from time import sleep biff=""2048 print " Payload sent "+ strlenbuff expl = socket.socket...

Stack overflow

Stack-based buffer overflow in the DoLBURPRequest function in libnldap in ndsd in Novell eDirectory 8.7.3.9 and earlier, and 8.8.1 and earlier in the 8.8.x series, allows remote attackers to cause a denial of service daemon crash or CPU consumption or execute arbitrary code via a long delRequest...