| VID |
22392 |
| Severity |
40 |
| Port |
8008,8009,8010 |
| Protocol |
TCP |
| Class |
WWW |
| Detailed Description |
The Novell SUSE Linux Enterprise Server is vulnerable to a heap-based buffer overflow vulnerability. Novell SUSE Linux Enterprise Server is a platform for open source computing in an enterprise environment. Novell Remote Manager HTTP service for SuSE Enterprise or Open Enterprise Server version 9.0 and possible other versions are vulnerable to a heap-based buffer overflow vulnerability in the Novell Remote Manager service (novell-nrm). By sending an HTTP POST request with a negative Content-Length parameter, a remote attacker could exploit this flaw and execute arbitrary code on the affected host. Since the 'httpstkd' service runs with the root privileges, the attacker could gain full control of the host.
* References:
http://archives.neohapsis.com/archives/bugtraq/2006-01/0214.html
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=371
* Platforms Affected:
Novell Open Enterprise Server Any version
SuSE Linux Enterprise Server 9 |
| Recommendation |
Apply the patch for the Novell Remote Manager (novell-nrm) service, available from the SUSE Security Announcement SUSE-SA:2006:002 at http://www.novell.com/linux/security/advisories/2006_02_novellnrm.html |
| Related URL |
CVE-2005-3655 (CVE) |
| Related URL |
16226 (SecurityFocus) |
| Related URL |
24111 (ISS) |
|
