Check Point Advisories

Novell eDirectory evtFilteredMonitorEventsRequest Function Heap Overflow (CVE-2006-4509)

Vulnerability
Protection

Check Point Reference:	CPAI-2006-312
Date Published:	22 Dec 2009
Severity:	Critical
Last Updated:	Tuesday 22 December, 2009
Source:
Industry Reference:	CVE-2006-4509
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Novell eDirectory is a set of services based on the Lightweight Directory Access Protocol (LDAP). On a default installation, the eDirectory LDAP server uses TCP port 389 for clear text LDAP communication. A heap buffer overflow vulnerability exists in the Novell eDirectory product line. The flaw is created by an improper buffer size calculations performed during the processing of client LDAP messages. A remote unauthenticated attacker can exploit the vulnerability to cause a denial of service condition on the target host or possibly inject and execute arbitrary code. In a simple attack case aimed at creating a denial of service condition, the affected eDirectory service will terminate. If the service is not configured to restart automatically, the service will be unavailable until it is restarted manually. In a sophisticated attack case where a malicious user is successful in injecting and executing malicious code, the behavior of the system is dependent on the nature of the injected code. Any code injected into the vulnerable component would execute in the security context of the service process, normally System.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Novell eDirectory evtFilteredMonitorEventsRequest Function Heap Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: LDAP Protection Violation.
Attack Information: Novell eDirectory evtFilteredMonitorEventsRequest function heap overflow