TUCoPS :: Networks :: va1514.htm

TUCoPS :: Networks :: va1514.htm
Novell eDirectory dhost.exe Content-Length Header Heap Overflow Vulnerability
ZDI-08-063: Novell eDirectory dhost.exe Content-Length Header Heap Overflow Vulnerability ZDI-08-063: Novell eDirectory dhost.exe Content-Length Header Heap Overflow Vulnerability

WkRJLTA4LTA2MzogTm92ZWxsIGVEaXJlY3RvcnkgZGhvc3QuZXhlIENvbnRlbnQtTGVuZ3RoIEhl
YWRlciBIZWFwIA0KT3ZlcmZsb3cgVnVsbmVyYWJpbGl0eQ0KaHR0cDovL3d3dy56ZXJvZGF5aW5p
dGlhdGl2ZS5jb20vYWR2aXNvcmllcy9aREktMDgtMDYzDQpPY3RvYmVyIDgsIDIwMDgNCg0KLS0g
Q1ZFIElEOg0KQ1ZFLTIwMDgtNDQ3OA0KDQotLSBBZmZlY3RlZCBWZW5kb3JzOg0KTm92ZWxsDQoN
Ci0tIEFmZmVjdGVkIFByb2R1Y3RzOg0KTm92ZWxsIGVEaXJlY3RvcnkNCg0KLS0gVGlwcGluZ1Bv
aW50KFRNKSBJUFMgQ3VzdG9tZXIgUHJvdGVjdGlvbjoNClRpcHBpbmdQb2ludCBJUFMgY3VzdG9t
ZXJzIGhhdmUgYmVlbiBwcm90ZWN0ZWQgYWdhaW5zdCB0aGlzDQp2dWxuZXJhYmlsaXR5IGJ5IERp
Z2l0YWwgVmFjY2luZSBwcm90ZWN0aW9uIGZpbHRlciBJRCAzNzEwLiANCkZvciBmdXJ0aGVyIHBy
b2R1Y3QgaW5mb3JtYXRpb24gb24gdGhlIFRpcHBpbmdQb2ludCBJUFMsIHZpc2l0Og0KDQogICAg
aHR0cDovL3d3dy50aXBwaW5ncG9pbnQuY29tDQoNCi0tIFZ1bG5lcmFiaWxpdHkgRGV0YWlsczoN
ClRoaXMgdnVsbmVyYWJpbGl0eSBhbGxvd3MgYXR0YWNrZXJzIHRvIGV4ZWN1dGUgYXJiaXRyYXJ5
IGNvZGUgb24NCnZ1bG5lcmFibGUgaW5zdGFsbGF0aW9ucyBvZiBOb3ZlbGwgZURpcmVjdG9yeS4g
QXV0aGVudGljYXRpb24gaXMgbm90DQpyZXF1aXJlZCB0byBleHBsb2l0IHRoaXMgdnVsbmVyYWJp
bGl0eS4NCg0KVGhlIHNwZWNpZmljIGZsYXcgcmVzaWRlcyBpbiB0aGUgd2ViIGNvbnNvbGUgcnVu
bmluZyBvbiBUQ1AgcG9ydHMgODAyOA0KYW5kIDgwMzAuIFRoZSBzZXJ2ZXIgZXhwb3NlcyBhIHdl
YiBpbnRlcmZhY2UgYW5kIGFjY2VwdHMgU09BUA0KY29ubmVjdGlvbnMuIFdoaWxlIHBhcnNpbmcg
dGhlIENvbnRlbnQtTGVuZ3RoIGhlYWRlciB3aXRoaW4gYSBTT0FQDQpyZXF1ZXN0IGFuIGludGVn
ZXIgb3ZlcmZsb3cgY2FuIG9jY3VyLiBUaGlzIGludGVnZXIgb3ZlcmZsb3cgdHJpZ2dlcnMgYQ0K
c3Vic2VxdWVudCBvdmVyZmxvdyBkdXJpbmcgYSBtZW1vcnkgY29weSBvcGVyYXRpb24gbGVhZGlu
ZyB0byBhcmJpdHJhcnkNCmNvZGUgZXhlY3V0aW9uIHVuZGVyIHRoZSBjb250ZXh0IG9mIHRoZSBT
WVNURU0gdXNlci4NCg0KLS0gVmVuZG9yIFJlc3BvbnNlOg0KTm92ZWxsIGhhcyBpc3N1ZWQgYW4g
dXBkYXRlIHRvIGNvcnJlY3QgdGhpcyB2dWxuZXJhYmlsaXR5LiBNb3JlDQpkZXRhaWxzIGNhbiBi
ZSBmb3VuZCBhdDoNCg0KaHR0cDovL3d3dy5ub3ZlbGwuY29tL3N1cHBvcnQvcGhwL3NlYXJjaC5k
bz9jbWQ9ZGlzcGxheUtDJmFtcDtkb2NUeXBlPWtjJmFtcDtleHRlcm5hbElkPTcwMDAwODcmYW1w
O3NsaWNlSWQ9MSZhbXA7ZG9jVHlwZUlEPURUX1RJRF8xXzEmYW1wO2RpYWxvZ0lEPTc4MDY2ODI5
JmFtcDtzdGF0ZUlkPTAlMjAwJTIwNzgwNjI5NTMNCg0KLS0gRGlzY2xvc3VyZSBUaW1lbGluZToN
CjIwMDgtMDQtMDggLSBWdWxuZXJhYmlsaXR5IHJlcG9ydGVkIHRvIHZlbmRvcg0KMjAwOC0xMC0w
OCAtIENvb3JkaW5hdGVkIHB1YmxpYyByZWxlYXNlIG9mIGFkdmlzb3J5DQoNCi0tIENyZWRpdDoN
ClRoaXMgdnVsbmVyYWJpbGl0eSB3YXMgZGlzY292ZXJlZCBieToNCiAgICAqIEFub255bW91cw0K
DQotLSBBYm91dCB0aGUgWmVybyBEYXkgSW5pdGlhdGl2ZSAoWkRJKToNCkVzdGFibGlzaGVkIGJ5
IFRpcHBpbmdQb2ludCwgVGhlIFplcm8gRGF5IEluaXRpYXRpdmUgKFpESSkgcmVwcmVzZW50cyAN
CmEgYmVzdC1vZi1icmVlZCBtb2RlbCBmb3IgcmV3YXJkaW5nIHNlY3VyaXR5IHJlc2VhcmNoZXJz
IGZvciByZXNwb25zaWJseQ0KZGlzY2xvc2luZyBkaXNjb3ZlcmVkIHZ1bG5lcmFiaWxpdGllcy4N
Cg0KUmVzZWFyY2hlcnMgaW50ZXJlc3RlZCBpbiBnZXR0aW5nIHBhaWQgZm9yIHRoZWlyIHNlY3Vy
aXR5IHJlc2VhcmNoDQp0aHJvdWdoIHRoZSBaREkgY2FuIGZpbmQgbW9yZSBpbmZvcm1hdGlvbiBh
bmQgc2lnbi11cCBhdDoNCg0KICAgIGh0dHA6Ly93d3cuemVyb2RheWluaXRpYXRpdmUuY29tDQoN
ClRoZSBaREkgaXMgdW5pcXVlIGluIGhvdyB0aGUgYWNxdWlyZWQgdnVsbmVyYWJpbGl0eSBpbmZv
cm1hdGlvbiBpcw0KdXNlZC4gVGlwcGluZ1BvaW50IGRvZXMgbm90IHJlLXNlbGwgdGhlIHZ1bG5l
cmFiaWxpdHkgZGV0YWlscyBvciBhbnkNCmV4cGxvaXQgY29kZS4gSW5zdGVhZCwgdXBvbiBub3Rp
ZnlpbmcgdGhlIGFmZmVjdGVkIHByb2R1Y3QgdmVuZG9yLA0KVGlwcGluZ1BvaW50IHByb3ZpZGVz
IGl0cyBjdXN0b21lcnMgd2l0aCB6ZXJvIGRheSBwcm90ZWN0aW9uIHRocm91Z2gNCml0cyBpbnRy
dXNpb24gcHJldmVudGlvbiB0ZWNobm9sb2d5LiBFeHBsaWNpdCBkZXRhaWxzIHJlZ2FyZGluZyB0
aGUNCnNwZWNpZmljcyBvZiB0aGUgdnVsbmVyYWJpbGl0eSBhcmUgbm90IGV4cG9zZWQgdG8gYW55
IHBhcnRpZXMgdW50aWwNCmFuIG9mZmljaWFsIHZlbmRvciBwYXRjaCBpcyBwdWJsaWNseSBhdmFp
bGFibGUuIEZ1cnRoZXJtb3JlLCB3aXRoIHRoZQ0KYWx0cnVpc3RpYyBhaW0gb2YgaGVscGluZyB0
byBzZWN1cmUgYSBicm9hZGVyIHVzZXIgYmFzZSwgVGlwcGluZ1BvaW50DQpwcm92aWRlcyB0aGlz
IHZ1bG5lcmFiaWxpdHkgaW5mb3JtYXRpb24gY29uZmlkZW50aWFsbHkgdG8gc2VjdXJpdHkNCnZl
bmRvcnMgKGluY2x1ZGluZyBjb21wZXRpdG9ycykgd2hvIGhhdmUgYSB2dWxuZXJhYmlsaXR5IHBy
b3RlY3Rpb24gb3INCm1pdGlnYXRpb24gcHJvZHVjdC4NCg0KT3VyIHZ1bG5lcmFiaWxpdHkgZGlz
Y2xvc3VyZSBwb2xpY3kgaXMgYXZhaWxhYmxlIG9ubGluZSBhdDoNCg0KICAgIGh0dHA6Ly93d3cu
emVyb2RheWluaXRpYXRpdmUuY29tL2Fkdmlzb3JpZXMvZGlzY2xvc3VyZV9wb2xpY3kvDQoNCkNP
TkZJREVOVElBTElUWSBOT1RJQ0U6IFRoaXMgZS1tYWlsIG1lc3NhZ2UsIGluY2x1ZGluZyBhbnkg
YXR0YWNobWVudHMsDQppcyBiZWluZyBzZW50IGJ5IDNDb20gZm9yIHRoZSBzb2xlIHVzZSBvZiB0
aGUgaW50ZW5kZWQgcmVjaXBpZW50KHMpIGFuZA0KbWF5IGNvbnRhaW4gY29uZmlkZW50aWFsLCBw
cm9wcmlldGFyeSBhbmQvb3IgcHJpdmlsZWdlZCBpbmZvcm1hdGlvbi4NCkFueSB1bmF1dGhvcml6
ZWQgcmV2aWV3LCB1c2UsIGRpc2Nsb3N1cmUgYW5kL29yIGRpc3RyaWJ1dGlvbiBieSBhbnkgDQpy
ZWNpcGllbnQgaXMgcHJvaGliaXRlZC4gIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNp
cGllbnQsIHBsZWFzZQ0KZGVsZXRlIGFuZC9vciBkZXN0cm95IGFsbCBjb3BpZXMgb2YgdGhpcyBt
ZXNzYWdlIHJlZ2FyZGxlc3Mgb2YgZm9ybSBhbmQNCmFueSBpbmNsdWRlZCBhdHRhY2htZW50cyBh
bmQgbm90aWZ5IDNDb20gaW1tZWRpYXRlbHkgYnkgY29udGFjdGluZyB0aGUNCnNlbmRlciB2aWEg
cmVwbHkgZS1tYWlsIG9yIGZvcndhcmRpbmcgdG8gM0NvbSBhdCBwb3N0bWFzdGVyQDNjb20uY29t
LiANCg=