| Check Point Reference: |
CPAI-2009-243 |
| Date Published: |
6 Nov 2009 |
| Severity: |
Critical
|
| Last Updated: |
Thursday 01 January, 2009 |
| Source: |
Secunia Advisory: SA36916 |
| Industry Reference: | N/A |
| Protection Provided by: |
|
| Who is Vulnerable? | Novell Netware 6.5 SP8 and prior versions |
| Vulnerability Description |
A buffer overflow vulnerability exists in Novell NetWare NFS Portmapper daemon. Netware is a network operating system developed by Novell, providing file sharing and other services such as printing and email. The vulnerability is due to a boundary error when handling RPC calls. Unauthenticated attackers can exploit this vulnerability by sending crafted CALLIT RPC calls to a vulnerable Novell NetWare system. Successful exploitation would lead to arbitrary code injection and execution. |
| Update/Patch Avaliable | The vendor, Novell, has released an advisory addressing this vulnerability:
http://download.novell.com/Download?buildid=DNxmXuyVPuY~ |
| Vulnerability Details | The vulnerability exists in Novell Netware's port mapper module, PKERNEL.NLM. The vulnerability is due to insufficient bounds checking in the remote procedure call. An attacker can craft a malicious CALLIT RPC message with invalid argument length to trigger the vulnerability. |
Feedback