Two vulnerabilities have been reported in Novell iManager, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to cause a DoS (Denial of Service).

1) A boundary error in the handling class names can be exploited to cause a stack-based buffer overflow by sending a specially crafted HTTP request containing overly large class names to "/nps/servlet/webacc/".

Successful exploitation allows execution of arbitrary code.

2) An off-by-one error in the handling of the "TREE" parameter during the login process can be exploited to crash the application via a specially crafted HTTP request.

The vulnerabilities are reported in versions 2.7.3 FTF3 and prior.

Solution
Update to version 2.7.4.

Provided and/or discovered by
Francisco Falcon, Core Security Technologies.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Core Security Technologies:
http://www.coresecurity.com/content/novell-imanager-buffer-overflow-off-by-one-vulnerabilities

Novell:
http://www.novell.com/support/viewContent.do?externalId=7006390

Deep Links
Links available to Secunia VIM customers