|
Novell Client Login Long Username/Context Buffer Overflow
|
|
Secunia Advisory:
|
SA30126
|
|
|
Release Date:
|
2008-05-13
|
|
Popularity:
|
2,912 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
Local system
|
|
Solution Status:
|
Unpatched
|
|
| Software: | Novell Client for Windows NT/2000/XP 4.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2008-2145
|
|
Description:
laurent gaffié has discovered a vulnerability in Novell Client, which can be exploited by malicious people with physical access to cause a DoS (Denial of Service) or compromise a vulnerable system.
The vulnerability is caused due to a boundary error within LOGINW32.DLL when processing usernames and eDirectory "Context" strings in the Novell Client login window. This can be exploited to cause a stack-based buffer overflow by entering an overly-long username and eDirectory "Context" strings, clicking on the "Did you forget your password?" link, and clicking "Ok".
Successful exploitation allows execution of arbitrary code in context of the winlogon.exe process when e.g. the workstation is locked or no user is currently logged in.
The vulnerability is confirmed in version 4.91 SP4 and including LOGINW32.DLL version 4.19.6.0. Other versions may also be affected.
Solution:
Grant only trusted users access to affected systems.
Provided and/or discovered by:
laurent gaffié
Original Advisory:
http://archives.neohapsis.com/archives/bugtraq/2008-05/0109.html
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
