Buffer overflow in Novell Edirectory
CVE-2006-5478
Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow remote attackers to execute arbitrary code via (1) a long HTTP Host header, which triggers an overflow in the BuildRedirectURL function; or vectors related to a username containing a . (dot) character in the (2) SMTP, (3) POP, (4) IMAP, (5) HTTP, or (6) Networked Messaging Application Protocol (NMAP) Netmail services.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.851 (99.7th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.840 · newest: 0.851 · change: +0.012
Affected products
- Novell Edirectory — versions 8.0, 8.5, 8.5.12a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.grok.org.uk/pipermail/full-disclosure/2006-October/050388.html (mailing-list)
- www.securityfocus.com/bid/20655 (vdb-entry)
- www.securityfocus.com/archive/1/449899/100/0/threaded (mailing-list)
- www.mnin.org/advisories/2006_novell_httpstk.pdf (Vendor Advisory)
- www.zerodayinitiative.com/advisories/ZDI-06-036.html
- www.zerodayinitiative.com/advisories/ZDI-06-035.html
- secure-support.novell.com/KanisaPlatform/Publishing/134/3096026_f.SAL_Public.ht…
- securitytracker.com/id (vdb-entry)
- securitytracker.com/id (vdb-entry)
- lists.grok.org.uk/pipermail/full-disclosure/2006-October/050382.html (mailing-list)
Frequently asked questions
- What is CVE-2006-5478?
- CVE-2006-5478 is a vulnerability in Novell Edirectory, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2006-10-24.
- Is CVE-2006-5478 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.