Novell fixes bug in eDirectory
A vulnerability in Novell's eDirectory LDAP server can be exploited by attackers on the local network to inject malicious code or carry out denial of service attacks. In its security advisory, Novell states that an oversize LDAP Extended Request query can trigger a stack overflow resulting in the overwriting of a function pointer. This apparently crashes the ndsd service, causes its Windows counterpart dhost.exe to generate a high processor load and in both cases may allow execution of injected code.
The bug affects versions 8.8.1 and earlier and 8.7.3.9 and earlier of the eDirectory server under Linux, Solaris, Windows 2000 and Server 2003. Registered users can download version 8.8.2 or later or version 8.7.3 with SP 10 or later, in which the bug is fixed.
See also:
- Security Vulnerability: Oversized DN Stack Overflow, security advisory from Novell
- Download the current version of the software from Novell (for registered users)
(mba)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
