{"cve": [{"lastseen": "2019-05-29T18:09:26", "bulletinFamily": "NVD", "description": "Multiple buffer overflows in Novell iPrint Client before 5.06 allow remote attackers to execute arbitrary code by calling the Novell iPrint ActiveX control (aka ienipp.ocx) with (1) a long third argument to the GetDriverFile method; a long first argument to the (2) GetPrinterURLList or (3) GetPrinterURLList2 method; (4) a long argument to the GetFileList method; a long argument to the (5) GetServerVersion, (6) GetResourceList, or (7) DeleteResource method, related to nipplib.dll; a long uploadPath argument to the (8) UploadPrinterDriver or (9) UploadResource method, related to URIs; (10) a long seventh argument to the UploadResource method; a long string in the (11) second, (12) third, or (13) fourth argument to the GetDriverSettings method, related to the IppGetDriverSettings function in nipplib.dll; or (14) a long eighth argument to the UploadResourceToRMS method.", "modified": "2017-08-08T01:31:00", "id": "CVE-2008-2431", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2431", "published": "2008-11-26T01:30:00", "title": "CVE-2008-2431", "type": "cve", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:09:26", "bulletinFamily": "NVD", "description": "Insecure method vulnerability in the GetFileList method in an unspecified ActiveX control in Novell iPrint Client before 5.06 allows remote attackers to list the image files in an arbitrary directory via a directory name in the argument.", "modified": "2008-11-26T05:00:00", "id": "CVE-2008-2432", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2432", "published": "2008-11-26T01:30:00", "title": "CVE-2008-2432", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "openvas": [{"lastseen": "2019-05-29T18:40:28", "bulletinFamily": "scanner", "description": "This host has Novell iPrint Client installed, which is prone\n to activex control vulnerabilities.", "modified": "2018-11-30T00:00:00", "published": "2008-08-27T00:00:00", "id": "OPENVAS:1361412562310900040", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310900040", "title": "Novell iPrint Client ActiveX Control Multiple Vulnerabilities", "type": "openvas", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: secpod_novell_iprint_client_actvx_mult_vuln_900040.nasl 12602 2018-11-30 14:36:58Z cfischer $\n# Description: Novell iPrint Client ActiveX Control Multiple Vulnerabilities\n#\n# Authors:\n# Sharath S <sharaths@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2008 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n##############################################################################\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.900040\");\n script_version(\"$Revision: 12602 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-30 15:36:58 +0100 (Fri, 30 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2008-08-27 11:53:45 +0200 (Wed, 27 Aug 2008)\");\n script_bugtraq_id(30813);\n script_cve_id(\"CVE-2008-2431\", \t\"CVE-2008-2432\");\n script_copyright(\"Copyright (C) 2008 SecPod\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"qod_type\", value:\"registry\");\n script_family(\"General\");\n script_name(\"Novell iPrint Client ActiveX Control Multiple Vulnerabilities\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_mandatory_keys(\"SMB/WindowsVersion\");\n script_require_ports(139, 445);\n script_tag(name:\"summary\", value:\"This host has Novell iPrint Client installed, which is prone\n to activex control vulnerabilities.\");\n script_tag(name:\"insight\", value:\"The flaws are due to,\n\n - boundary errors in ienipp.ocx file when processing GetDriverFile(),\n GetFileList(), ExecuteRequest(), UploadPrinterDriver(),\n UploadResource(), UploadResource(), UploadResourceToRMS(),\n GetServerVersion(), GetResourceList(), or DeleteResource() methods.\n\n - a boundary error in nipplib.dll when processing IppGetDriverSettings()\n while creating a server reference or interpreting a URI.\n\n - an error in the GetFileList() method returns a list of images\n (eg., .jpg, .jpeg, .gif, and .bmp) in a directory specified as\n argument to the method.\");\n script_tag(name:\"affected\", value:\"Novell iPrint Client version 4.36 and prior on Windows (All).\n\n Affected Platform : Windows (Any).\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"solution\", value:\"Upgrade to Novell iPrint Client version 5.40 or later.\");\n script_tag(name:\"impact\", value:\"Remote exploitation could allow execution of arbitrary code to\n cause the server to crash or denying the access to legitimate users.\");\n script_xref(name:\"URL\", value:\"http://www.frsirt.com/english/advisories/2008/2429\");\n script_xref(name:\"URL\", value:\"http://download.novell.com/index.jsp\");\n exit(0);\n}\n\n\n include(\"smb_nt.inc\");\n\n if(!get_kb_item(\"SMB/WindowsVersion\")){\n exit(0);\n }\n\n iPrintVer = registry_get_sz(key:\"SOFTWARE\\Novell-iPrint\",\n\t\t\t item:\"Current Version\");\n if(!iPrintVer){\n\texit(0);\n }\n\n if(ereg(pattern:\"^v0?([0-3]\\..*|4\\.([0-2][0-9]|3[0-6])\\.00)$\",\n\t string:iPrintVer)){\n\t security_message( port: 0, data: \"The target host was found to be vulnerable\" );\n }\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-07-02T21:10:10", "bulletinFamily": "scanner", "description": "This host has Novell iPrint Client installed, which is prone\n to activex control vulnerabilities.", "modified": "2017-02-20T00:00:00", "published": "2008-08-27T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=900040", "id": "OPENVAS:900040", "title": "Novell iPrint Client ActiveX Control Multiple Vulnerabilities", "type": "openvas", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: secpod_novell_iprint_client_actvx_mult_vuln_900040.nasl 5370 2017-02-20 15:24:26Z cfi $\n# Description: Novell iPrint Client ActiveX Control Multiple Vulnerabilities\n#\n# Authors:\n# Sharath S <sharaths@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2008 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n##############################################################################\n\ntag_impact = \"Remote exploitation could allow execution of arbitrary code to\n cause the server to crash or denying the access to legitimate users.\n Impact Level : Application\";\n\ntag_solution = \"Upgrade to Novell iPrint Client version 5.40 or later,\n For updates refer to http://download.novell.com/index.jsp\";\n\ntag_affected = \"Novell iPrint Client version 4.36 and prior on Windows (All).\n\n Affected Platform : Windows (Any).\";\n\ntag_insight = \"The flaws are due to,\n - boundary errors in ienipp.ocx file when processing GetDriverFile(),\n GetFileList(), ExecuteRequest(), UploadPrinterDriver(),\n UploadResource(), UploadResource(), UploadResourceToRMS(),\n GetServerVersion(), GetResourceList(), or DeleteResource() methods.\n - a boundary error in nipplib.dll when processing IppGetDriverSettings()\n while creating a server reference or interpreting a URI.\n - an error in the GetFileList() method returns a list of images\n (eg., .jpg, .jpeg, .gif, and .bmp) in a directory specified as\n argument to the method.\";\n\n\ntag_summary = \"This host has Novell iPrint Client installed, which is prone\n to activex control vulnerabilities.\";\n\n\nif(description)\n{\n script_id(900040);\n script_version(\"$Revision: 5370 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-02-20 16:24:26 +0100 (Mon, 20 Feb 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-08-27 11:53:45 +0200 (Wed, 27 Aug 2008)\");\n script_bugtraq_id(30813);\n script_cve_id(\"CVE-2008-2431\",\t\"CVE-2008-2432\");\n script_copyright(\"Copyright (C) 2008 SecPod\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"qod_type\", value:\"registry\");\n script_family(\"General\");\n script_name(\"Novell iPrint Client ActiveX Control Multiple Vulnerabilities\");\n script_dependencies(\"secpod_reg_enum.nasl\");\n script_mandatory_keys(\"SMB/WindowsVersion\");\n script_require_ports(139, 445);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"impact\" , value : tag_impact);\n script_xref(name : \"URL\" , value : \"http://www.frsirt.com/english/advisories/2008/2429\");\n exit(0);\n}\n\n\n include(\"smb_nt.inc\");\n\n if(!get_kb_item(\"SMB/WindowsVersion\")){\n exit(0);\n }\n\n iPrintVer = registry_get_sz(key:\"SOFTWARE\\Novell-iPrint\",\n\t\t\t item:\"Current Version\");\n if(!iPrintVer){\n\texit(0);\n }\n\n if(ereg(pattern:\"^v0?([0-3]\\..*|4\\.([0-2][0-9]|3[0-6])\\.00)$\",\n\t string:iPrintVer)){\n\t security_message(0);\n }\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2019-02-21T01:11:09", "bulletinFamily": "scanner", "description": "Novell iPrint Client is installed on the remote host.\n\nAn ActiveX control included with Novell iPrint Client is affected by multiple vulnerabilities.\n\n - Vulnerabilities affecting GetDriverFile(), GetDriverSettings() GetPrinterURLList(), GetFileList(), GetServerVersion(), UploadResource(), ExecuteRequest(), UploadResource(), and UploadResourceToRMS() methods in 'ienipp.ocx' could be exploited to perform stack based buffer overflows and execute arbitrary code on the remote system. (CVE-2008-2431) \n\n - A vulnerability in IppGetDriverSettings() method in nipplib.dll could be exploited to perform a stack based buffer overflow (CVE-2008-5231). \n\n - A vulnerability in GetFileList() method may disclose sensitive information. (CVE-2008-2432)", "modified": "2018-11-15T00:00:00", "id": "NOVELL_IPRINT_ACTIVEX_MULTIPLE_VULNS.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=34049", "published": "2008-08-26T00:00:00", "title": "Novell iPrint Client ActiveX Control Multiple Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(34049);\n script_version(\"1.21\");\n script_cvs_date(\"Date: 2018/11/15 20:50:27\");\n\n script_cve_id(\"CVE-2008-2431\", \"CVE-2008-2432\", \"CVE-2008-5231\");\n script_bugtraq_id(30813);\n script_xref(name:\"Secunia\", value:\"30667\");\n\n script_name(english:\"Novell iPrint Client ActiveX Control Multiple Vulnerabilities\");\n script_summary(english:\"Checks version of Novell iPrint ActiveX control\");\n \n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host has an ActiveX control that is affected by\nmultiple vulnerabilities.\" );\n script_set_attribute(attribute:\"description\", value:\n\"Novell iPrint Client is installed on the remote host.\n\nAn ActiveX control included with Novell iPrint Client is affected\nby multiple vulnerabilities.\n\n - Vulnerabilities affecting GetDriverFile(), \n GetDriverSettings() GetPrinterURLList(), GetFileList(),\n GetServerVersion(), UploadResource(), ExecuteRequest(), \n UploadResource(), and UploadResourceToRMS() methods in \n 'ienipp.ocx' could be exploited to perform stack based \n buffer overflows and execute arbitrary code on the \n remote system. (CVE-2008-2431) \n\n - A vulnerability in IppGetDriverSettings() method in \n nipplib.dll could be exploited to perform a stack based \n buffer overflow (CVE-2008-5231). \n\n - A vulnerability in GetFileList() method may disclose \n sensitive information. (CVE-2008-2432)\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://secuniaresearch.flexerasoftware.com/secunia_research/2008-27/advisory/\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://secuniaresearch.flexerasoftware.com/secunia_research/2008-30/advisory/\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://download.novell.com/Download?buildid=_BILqzyqc2g~\" );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to version 5.06.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'D2ExploitPack');\n script_cwe_id(119, 200);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2008/08/26\");\n script_set_attribute(attribute:\"patch_publication_date\", value: \"2008/08/22\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:novell:iprint\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"smb_hotfixes.nasl\",\"os_fingerprint.nasl\");\n script_require_keys(\"SMB/Registry/Enumerated\");\n script_require_ports(139, 445);\n\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_activex_func.inc\");\n\nif (!get_kb_item(\"SMB/Registry/Enumerated\")) exit(0);\n\nos = get_kb_item(\"Host/OS\");\nif(isnull(os))exit(0);\n\nif (\"Vista\" >< os) os = \"Vista\";\nelse os = \"Windows\";\n\n# Locate the file used by the controls.\nif (activex_init() != ACX_OK) exit(0);\n\nclsid = \"{36723F97-7AA0-11D4-8919-FF2D71D0D32C}\";\nfile = activex_get_filename(clsid:clsid);\nif (file)\n{\n ver = activex_get_fileversion(clsid:clsid);\n v = split(ver,sep:\".\",keep:FALSE); \n\n if (ver && activex_check_fileversion(clsid:clsid, fix:\"5.0.6.0\") == TRUE)\n {\n report = NULL;\n if (report_paranoia > 1)\n report = string(\n \"\\n\",\n \"Version \",string(v[0],\".\",v[1],v[2]), \" of Novell iPrint Client for \",os,\"\\n\",\n \"\\n\",\n \" \", file, \"\\n\",\n \"\\n\",\n \"Note, though, that Nessus did not check whether the kill bit was\\n\",\n \"set for the control's CLSID because of the Report Paranoia setting\\n\",\n \"in effect when this scan was run.\\n\"\n );\n else if (activex_get_killbit(clsid:clsid) == 0)\n report = string(\n \"\\n\",\n \"Version \",string(v[0],\".\",v[1],v[2]), \" of Novell iPrint Client for \",os,\"\\n\",\n \"\\n\",\n \" \", file, \"\\n\",\n \"\\n\",\n \"Moreover, its kill bit is not set so it is accessible via Internet\\n\",\n \"Explorer.\\n\"\n );\n if (report)\n {\n if (report_verbosity) security_hole(port:kb_smb_transport(), extra:report);\n else security_hole(kb_smb_transport());\n }\n }\n}\nactivex_end();\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:27", "bulletinFamily": "software", "description": "====================================================================== \r\n\r\n Secunia Research 25/08/2008\r\n\r\n - Novell iPrint Client ActiveX Control -\r\n - "GetFileList()" Information Disclosure -\r\n\r\n====================================================================== \r\nTable of Contents\r\n\r\nAffected Software....................................................1\r\nSeverity.............................................................2\r\nVendor's Description of Software.....................................3\r\nDescription of Vulnerability.........................................4\r\nSolution.............................................................5\r\nTime Table...........................................................6\r\nCredits..............................................................7\r\nReferences...........................................................8\r\nAbout Secunia........................................................9\r\nVerification........................................................10\r\n\r\n====================================================================== \r\n1) Affected Software \r\n\r\n* Novell iPrint Client 4.36\r\n* Novell iPrint Client for Windows Vista 5.04\r\n\r\nNOTE: Other versions may also be affected.\r\n\r\n====================================================================== \r\n2) Severity \r\n\r\nRating: Less critical\r\nImpact: Exposure of sensitive information\r\nWhere: Remote\r\n\r\n====================================================================== \r\n3) Vendor's Description of Software \r\n\r\n"Neither you nor your users have time to devote to a complex printing\r\nenvironment. That's why Novell iPrint extends print services securely\r\nacross multiple networks and operating systems. Using proven Internet\r\ntechnologies, iPrint transforms your Novell Distributed Print \r\nServices\u2122 (NDPS\u00ae) printers into Net-enabled printers, making all your\r\nprinting resources instantly accessible with a Web browser and a few\r\nmouse clicks".\r\n\r\nProduct Link:\r\nhttp://www.novell.com/products/openenterpriseserver/iprint.html\r\n\r\n====================================================================== \r\n4) Description of Vulnerability\r\n\r\nSecunia Research has discovered a security issue in Novell iPrint \r\nClient, which can be exploited by malicious people to gain knowledge \r\nof potentially sensitive information.\r\n\r\nThe insecure "GetFileList()" method returns a list of images (".jpg",\r\n".jpeg", ".gif", and ".bmp") in a directory specified as argument to\r\nthe method. This can be exploited to gain knowledge of any image file\r\nnames in arbitrary directories on a user's system, including e.g. the\r\nuser's "My Pictures" / "Pictures" folder without knowledge of the\r\nuser's username.\r\n\r\n====================================================================== \r\n5) Solution \r\n\r\nUpdate to version 5.06.\r\n\r\n====================================================================== \r\n6) Time Table \r\n\r\n20/06/2008 - Vendor notified.\r\n23/06/2008 - Vendor response.\r\n07/07/2008 - Vendor reports that vulnerability has been addressed.\r\n08/07/2008 - Vendor provides new version for testing.\r\n08/07/2008 - Vendor informed that vulnerability is not fixed.\r\n10/07/2008 - Details on vulnerability forwarded.\r\n21/07/2008 - Vendor reports that vulnerability was missed and that a\r\n new tracking number will be generated.\r\n22/08/2008 - Vendor issues fixed version for Vista.\r\n25/08/2008 - Public disclosure.\r\n\r\n====================================================================== \r\n7) Credits \r\n\r\nDiscovered by Carsten Eiram, Secunia Research.\r\n\r\n====================================================================== \r\n8) References\r\n\r\nThe Common Vulnerabilities and Exposures (CVE) project has assigned \r\nCVE-2008-2432 for the vulnerability.\r\n\r\n====================================================================== \r\n9) About Secunia\r\n\r\nSecunia offers vulnerability management solutions to corporate\r\ncustomers with verified and reliable vulnerability intelligence\r\nrelevant to their specific system configuration:\r\n\r\nhttp://corporate.secunia.com/\r\n\r\nSecunia also provides a publicly accessible and comprehensive advisory\r\ndatabase as a service to the security community and private \r\nindividuals, who are interested in or concerned about IT-security.\r\n\r\nhttp://secunia.com/\r\n\r\nSecunia believes that it is important to support the community and to\r\ndo active vulnerability research in order to aid improving the \r\nsecurity and reliability of software in general:\r\n\r\nhttp://corporate.secunia.com/secunia_research/33/\r\n\r\nSecunia regularly hires new skilled team members. Check the URL below\r\nto see currently vacant positions:\r\n\r\nhttp://secunia.com/secunia_vacancies/\r\n\r\nSecunia offers a FREE mailing list called Secunia Security Advisories:\r\n\r\nhttp://secunia.com/secunia_security_advisories/ \r\n\r\n====================================================================== \r\n10) Verification \r\n\r\nPlease verify this advisory by visiting the Secunia website:\r\nhttp://secunia.com/secunia_research/2008-30/\r\n\r\nComplete list of vulnerability reports published by Secunia Research:\r\nhttp://secunia.com/secunia_research/\r\n\r\n======================================================================", "modified": "2008-08-26T00:00:00", "published": "2008-08-26T00:00:00", "id": "SECURITYVULNS:DOC:20410", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20410", "title": "Secunia Research: Novell iPrint Client ActiveX Control "GetFileList()" Information Disclosure", "type": "securityvulns", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2018-08-31T11:10:27", "bulletinFamily": "software", "description": "====================================================================== \r\n\r\n Secunia Research 25/08/2008\r\n\r\n - Novell iPrint Client ActiveX Control Multiple Buffer Overflows -\r\n\r\n====================================================================== \r\nTable of Contents\r\n\r\nAffected Software....................................................1\r\nSeverity.............................................................2\r\nVendor's Description of Software.....................................3\r\nDescription of Vulnerability.........................................4\r\nSolution.............................................................5\r\nTime Table...........................................................6\r\nCredits..............................................................7\r\nReferences...........................................................8\r\nAbout Secunia........................................................9\r\nVerification........................................................10\r\n\r\n====================================================================== \r\n1) Affected Software \r\n\r\n* Novell iPrint Client 4.36\r\n\r\nNOTE: Other versions may also be affected.\r\n\r\n====================================================================== \r\n2) Severity \r\n\r\nRating: Highly critical\r\nImpact: System compromise\r\nWhere: Remote\r\n\r\n====================================================================== \r\n3) Vendor's Description of Software \r\n\r\n"Neither you nor your users have time to devote to a complex printing\r\nenvironment. That's why Novell iPrint extends print services securely\r\nacross multiple networks and operating systems. Using proven Internet\r\ntechnologies, iPrint transforms your Novell Distributed Print \r\nServices\u2122 (NDPS\u00ae) printers into Net-enabled printers, making all your\r\nprinting resources instantly accessible with a Web browser and a few\r\nmouse clicks".\r\n\r\nProduct Link:\r\nhttp://www.novell.com/products/openenterpriseserver/iprint.html\r\n\r\n====================================================================== \r\n4) Description of Vulnerability\r\n\r\nSecunia Research has discovered multiple vulnerabilities in Novell\r\niPrint Client, which can be exploited by malicious people to \r\ncompromise a user's system.\r\n\r\n1) A boundary error in the Novell iPrint ActiveX control (ienipp.ocx)\r\nwhen handling the "GetDriverFile()" method can be exploited to cause a\r\nstack-based buffer overflow by passing an overly long string as the \r\nthird argument.\r\n\r\n2) Two boundary errors in the Novell iPrint ActiveX control \r\n(ienipp.ocx) when constructing a URI based on input to the \r\n"GetPrinterURLList()" and "GetPrinterURLList2()" methods can be \r\nexploited to cause limited stack-based buffer overflows via an overly\r\nlong string passed as the 1st argument.\r\n\r\n3) A boundary error in the Novell iPrint ActiveX control (ienipp.ocx)\r\nwhen handling the "GetFileList()" method can be exploited to cause a \r\nheap-based buffer overflow via an overly long argument.\r\n\r\n4) Various boundary errors in nipplib.dll when e.g. creating a server\r\nreference or interpreting a URI can be exploited to cause stack-based \r\nand heap-based buffer overflows by e.g. passing an overly long string \r\nas argument to the "GetServerVersion()", "GetResourceList()", or \r\n"DeleteResource()" methods provided by the Novell iPrint ActiveX \r\ncontrol (ienipp.ocx).\r\n\r\n5) Boundary errors in the Novell iPrint ActiveX control (ienipp.ocx) \r\nwhen constructing a URI based on input to the "UploadPrinterDriver()"\r\nand "UploadResource()" methods can be exploited to cause a heap-based \r\nbuffer overflow and limited stack-based buffer overflow via an overly \r\nlong, specially crafted "uploadPath" argument.\r\n\r\n6) A boundary error in the Novell iPrint ActiveX control (ienipp.ocx) \r\nwhen copying "target-frame" option values passed to the \r\n"ExecuteRequest()" method can be exploited to cause a limited \r\nstack-based buffer overflow via an overly long "target-frame" option \r\nvalue.\r\n\r\n7) A boundary error in the Novell iPrint ActiveX control (ienipp.ocx)\r\nwhen handling the "UploadResource()" method can be exploited to cause\r\na stack-based buffer overflow by passing an overly long string as the\r\n7th argument.\r\n\r\n8) Three boundary errors in nipplib.dll within the \r\n"IppGetDriverSettings()" function can be exploited to cause \r\nstack-based buffer overflows by passing an overly long string as the\r\n2nd, 3rd, or 4th argument of the "GetDriverSettings()" method provided\r\nby Novell iPrint ActiveX control (ienipp.ocx).\r\n\r\n9) A boundary error in the Novell iPrint ActiveX control (ienipp.ocx)\r\nwhen handling the "UploadResourceToRMS" method can be exploited to \r\ncause a stack-based buffer overflow by passing an overly long string \r\nas the 8th argument.\r\n\r\n====================================================================== \r\n5) Solution \r\n\r\nThe vulnerabilities are fixed in version 5.06.\r\n\r\n====================================================================== \r\n6) Time Table \r\n\r\n18/06/2008 - Vendor notified (1st batch of vulnerabilities)\r\n18/06/2008 - Vendor response.\r\n23/06/2008 - Vendor notified (2nd batch of vulnerabilities)\r\n23/06/2008 - Vendor response.\r\n27/06/2008 - Vendor notified (3rd batch of vulnerabilities)\r\n27/06/2008 - Vendor response.\r\n07/07/2008 - Vendor reports that vulnerabilities have been addressed.\r\n08/07/2008 - Vendor provides new version for testing.\r\n08/07/2008 - Vendor informed that all vulnerabilities are fixed.\r\n22/08/2008 - Vendor issues fixed version for Vista.\r\n25/08/2008 - Public disclosure.\r\n\r\n====================================================================== \r\n7) Credits \r\n\r\nDiscovered by Carsten Eiram, Secunia Research.\r\n\r\n====================================================================== \r\n8) References\r\n\r\nThe Common Vulnerabilities and Exposures (CVE) project has assigned \r\nCVE-2008-2431 for the vulnerabilities.\r\n\r\n====================================================================== \r\n9) About Secunia\r\n\r\nSecunia offers vulnerability management solutions to corporate\r\ncustomers with verified and reliable vulnerability intelligence\r\nrelevant to their specific system configuration:\r\n\r\nhttp://corporate.secunia.com/\r\n\r\nSecunia also provides a publicly accessible and comprehensive advisory\r\ndatabase as a service to the security community and private \r\nindividuals, who are interested in or concerned about IT-security.\r\n\r\nhttp://secunia.com/\r\n\r\nSecunia believes that it is important to support the community and to\r\ndo active vulnerability research in order to aid improving the \r\nsecurity and reliability of software in general:\r\n\r\nhttp://corporate.secunia.com/secunia_research/33/\r\n\r\nSecunia regularly hires new skilled team members. Check the URL below\r\nto see currently vacant positions:\r\n\r\nhttp://secunia.com/secunia_vacancies/\r\n\r\nSecunia offers a FREE mailing list called Secunia Security Advisories:\r\n\r\nhttp://secunia.com/secunia_security_advisories/ \r\n\r\n====================================================================== \r\n10) Verification \r\n\r\nPlease verify this advisory by visiting the Secunia website:\r\nhttp://secunia.com/secunia_research/2008-27/\r\n\r\nComplete list of vulnerability reports published by Secunia Research:\r\nhttp://secunia.com/secunia_research/\r\n\r\n======================================================================", "modified": "2008-08-26T00:00:00", "published": "2008-08-26T00:00:00", "id": "SECURITYVULNS:DOC:20411", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20411", "title": "Secunia Research: Novell iPrint Client ActiveX Control Multiple Buffer Overflows", "type": "securityvulns", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "saint": [{"lastseen": "2016-10-03T15:01:56", "bulletinFamily": "exploit", "description": "Added: 09/16/2008 \nCVE: [CVE-2008-2431](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2431>) \nBID: [30813](<http://www.securityfocus.com/bid/30813>) \nOSVDB: [51684](<http://www.osvdb.org/51684>) \n\n\n### Background\n\nNovell iPrint is an application which allows users to install and manage printers. Novell iPrint installs the Novell iPrint ActiveX control named `**ienipp.ocx**`. \n\n### Problem\n\nA buffer overflow vulnerability in the Novell iPrint ActiveX control allows command execution when a user loads a web page which calls the `**GetDriverFile**` method with specially crafted arguments. \n\n### Resolution\n\nUpgrade to Novell iPrint client 5.06 or higher. \n\n### References\n\n<http://secunia.com/secunia_research/2008-27/advisory/> \n\n\n### Limitations\n\nExploit works on Novell iPrint Client 4.36.00 and requires a user to open the exploit page in Internet Explorer. \n\n### Platforms\n\nWindows \n \n\n", "modified": "2008-09-16T00:00:00", "published": "2008-09-16T00:00:00", "id": "SAINT:278C60F772BD510E4FDAEDCAC10D8F6F", "href": "http://www.saintcorporation.com/cgi-bin/exploit_info/novell_iprint_activex_getdriverfile", "type": "saint", "title": "Novell iPrint ActiveX control GetDriverFile buffer overflow", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T17:19:51", "bulletinFamily": "exploit", "description": "Added: 09/16/2008 \nCVE: [CVE-2008-2431](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2431>) \nBID: [30813](<http://www.securityfocus.com/bid/30813>) \nOSVDB: [51684](<http://www.osvdb.org/51684>) \n\n\n### Background\n\nNovell iPrint is an application which allows users to install and manage printers. Novell iPrint installs the Novell iPrint ActiveX control named `**ienipp.ocx**`. \n\n### Problem\n\nA buffer overflow vulnerability in the Novell iPrint ActiveX control allows command execution when a user loads a web page which calls the `**GetDriverFile**` method with specially crafted arguments. \n\n### Resolution\n\nUpgrade to Novell iPrint client 5.06 or higher. \n\n### References\n\n<http://secunia.com/secunia_research/2008-27/advisory/> \n\n\n### Limitations\n\nExploit works on Novell iPrint Client 4.36.00 and requires a user to open the exploit page in Internet Explorer. \n\n### Platforms\n\nWindows \n \n\n", "modified": "2008-09-16T00:00:00", "published": "2008-09-16T00:00:00", "id": "SAINT:98EC5383E7D8D38B5A15C94C3F18A4F8", "href": "http://download.saintcorporation.com/cgi-bin/exploit_info/novell_iprint_activex_getdriverfile", "type": "saint", "title": "Novell iPrint ActiveX control GetDriverFile buffer overflow", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-06-04T23:19:30", "bulletinFamily": "exploit", "description": "Added: 09/16/2008 \nCVE: [CVE-2008-2431](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2431>) \nBID: [30813](<http://www.securityfocus.com/bid/30813>) \nOSVDB: [51684](<http://www.osvdb.org/51684>) \n\n\n### Background\n\nNovell iPrint is an application which allows users to install and manage printers. Novell iPrint installs the Novell iPrint ActiveX control named `**ienipp.ocx**`. \n\n### Problem\n\nA buffer overflow vulnerability in the Novell iPrint ActiveX control allows command execution when a user loads a web page which calls the `**GetDriverFile**` method with specially crafted arguments. \n\n### Resolution\n\nUpgrade to Novell iPrint client 5.06 or higher. \n\n### References\n\n<http://secunia.com/secunia_research/2008-27/advisory/> \n\n\n### Limitations\n\nExploit works on Novell iPrint Client 4.36.00 and requires a user to open the exploit page in Internet Explorer. \n\n### Platforms\n\nWindows \n \n\n", "modified": "2008-09-16T00:00:00", "published": "2008-09-16T00:00:00", "id": "SAINT:4B32EAD846FD3124A33898A0A68C2A32", "href": "https://my.saintcorporation.com/cgi-bin/exploit_info/novell_iprint_activex_getdriverfile", "title": "Novell iPrint ActiveX control GetDriverFile buffer overflow", "type": "saint", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "d2": [{"lastseen": "2019-05-29T17:19:07", "bulletinFamily": "exploit", "description": "**Name**| d2sec_iprint2 \n---|--- \n**CVE**| CVE-2008-2431 \n**Exploit Pack**| [D2ExploitPack](<http://http://www.d2sec.com/products.htm>) \n**Description**| Novell iPrint Client ienipp.ocx ActiveX Stack Overflow \n**Notes**| \n", "modified": "2008-11-26T01:30:00", "published": "2008-11-26T01:30:00", "id": "D2SEC_IPRINT2", "href": "http://exploitlist.immunityinc.com/home/exploitpack/D2ExploitPack/d2sec_iprint2", "title": "DSquare Exploit Pack: D2SEC_IPRINT2", "type": "d2", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}]}
