Secunia

Description
Some vulnerabilities have been reported in Novell iPrint Client, which can be exploited by malicious people to manipulate certain data or compromise a user's system.

1) A boundary error in the ActiveX control (ienipp.ocx) when parsing "operation" parameters can be exploited to cause a stack-based buffer overflow via an overly long value.

2) A boundary error in the ActiveX control when parsing parameter names supplied via <embed> tags can be exploited to cause a buffer overflow.

3) A boundary error in the ActiveX control when constructing a debug string based on input e.g. supplied to the "ExecuteRequest()" method can be exploited to cause a stack-based buffer overflow via an overly long string.

4) A logic error in nipplib.dll when removing files can be exploited via the "CleanupUploadFiles()" method provided by the ActiveX control to recursively delete files on a user's system.

Successful exploitation of vulnerabilities #1 through #3 may allow execution of arbitrary code.

The vulnerabilities are reported in version 5.40. Other versions may also be affected.

Solution
Update to version 5.42.
Further details available in Customer Area

Provided and/or discovered by
1-2) Ivan Almuina via ZDI.
3-4) Aaron Portnoy, TippingPoint DVLabs.

Additional details provided by Secunia Research.

Changelog
Further details available in Customer Area

Original Advisory
Novell:
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5078392.html
http://www.novell.com/support/viewContent.do?externalId=7006675
http://www.novell.com/support/viewContent.do?externalId=7006676
http://www.novell.com/support/viewContent.do?externalId=7006677
http://www.novell.com/support/viewContent.do?externalId=7006678

TippingPoint DVLabs:
http://dvlabs.tippingpoint.com/advisory/TPTI-10-05
http://dvlabs.tippingpoint.com/advisory/TPTI-10-06

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-139/
http://www.zerodayinitiative.com/advisories/ZDI-10-140/

Technical Analysis
Further details available in Customer Area

Deep Links
Links available in Customer Area