Secunia

A vulnerability has been reported in Novell eDirectory, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within dhost.exe when processing "Connection" headers in a HTTP request. This can be exploited to cause dhost.exe to consume large amounts of CPU resource by e.g. sending an HTTP request containing two "Connection" headers or a "Connection" header with two values to default port 8028/TCP.

The vulnerability affects the following versions on Windows 2000/2003 systems:
* Novell eDirectory 8.8.1 and prior
* Novell eDirectory 8.7.3.9 and prior

Solution
Update to version 8.8.2 or apply eDirectory 8.7.3 sp10.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Nicholas Gregorie.

Changelog
Further details available in Customer Area

Original Advisory
Novell (3829452):
http://www.novell.com/support/viewContent.do?externalId=3829452&sliceId=1

http://archives.neohapsis.com/archives/bugtraq/2008-05/0066.html

Deep Links
Links available in Customer Area