Check Point Advisories

Novell eDirectory iMonitor NDS Server Buffer Overflow (CVE-2005-2551; CVE-2006-2496)

Vulnerability
Protection

Check Point Reference:	CPAI-2005-278
Date Published:	10 Jun 2010
Severity:	Critical
Last Updated:	Thursday 10 June, 2010
Source:
Industry Reference:	CVE-2005-2551 CVE-2006-2496
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Novell eDirectory is a Lightweight Directory Access Protocol (LDAP) server intended for use as a part of an identity management solution. The product is made available for multiple platforms including NetWare, Unix-like systems, and Windows. iMonitor, one of the many components of eDirectory, is a web-based utility that helps the customer to monitor and diagnose the eDirectory server. There exists a buffer overflow vulnerability in Novell eDirectory Server iMonitor. The vulnerability is caused by an improper boundary checking when processing HTTP requests. An unauthenticated remote attacker can exploit the vulnerability to cause denial of service, or execute arbitrary code on the target system. Any code would be executed with the privileges of the currently running iMonitor service, normally System. In case of an attack aimed at creating a denial of service condition, the affected iMonitor service will terminate. If the service is not configured to restart automatically, the service will be unavailable until the it is restarted manually. In case of an attack where code injection and execution is successful, the behavior of the system is dependent on the intended purpose of the injected code. Any code injected into the vulnerable component would execute in the security context of the service process, normally System.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Novell eDirectory iMonitor NDS Server Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: LDAP Protection Violation.
Attack Information: Novell eDirectory iMonitor NDS server buffer overflow