Update Protection against Novell eDirectory evtFilteredMonitorEventsRequest Function Heap Overflow
| Check Point Reference: | CPAI-2006-312 | |
| Date Published: | ||
| Severity: | ||
| Last Updated: | ||
| Source: | Secunia Advisory: SA22506 | |
| Industry Reference(s): | CVE-2006-4509 | |
| Protection Provided by: |
Security Gateway
|
|
| Who is Vulnerable? Novell eDirectory 8.7.3.8 and priors Novell eDirectory 8.8.1 and priors | ||
| Vulnerability Description Novell eDirectory is a set of services based on the Lightweight Directory Access Protocol (LDAP). On a default installation, the eDirectory LDAP server uses TCP port 389 for clear text LDAP communication and TCP port 636 for encrypted communication. |
||
|
Vulnerability Details A heap buffer overflow vulnerability exists in the Novell eDirectory product line. The flaw is created by improper buffer size calculations performed during the processing of client LDAP messages. A remote unauthenticated attacker can exploit the vulnerability to cause a denial of service condition on the target host or possibly inject and execute arbitrary code. In a simple attack case aimed at creating a denial of service condition, the affected eDirectory service will terminate. If the service is not configured to restart automatically, the service will be unavailable until it is restarted manually. In a sophisticated attack scenario where a malicious user is successful in injecting and executing supplied code, the behaviour of the system is dependent on the nature of the injected code. Any code injected into the vulnerable component would execute in the security context of the service process. On Windows systems, the service is running as System by default. |
Protection Overview
This protection will detect and block attempts to exploit this vulnerability.
In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, Protection tab and select the version of your choice.
To configure the defense, select your product from the list below and follow the related protection steps.