Heap-Based Buffer Overflow Vulnerability in Novell eDirectory

CVE-2008-4480

Summary

A heap-based buffer overflow vulnerability exists in the dhost.exe component of Novell eDirectory versions prior to 8.8.3 and 8.7.3 before 8.7.3.10 ftf1. Remote attackers can exploit this vulnerability by sending a specially crafted Netware Core Protocol message (opcode 0x24), leading to a calculation error that results in under-allocation of a heap buffer. Successful exploitation could potentially allow an attacker to execute arbitrary code on the affected system.

References