In association with heise online

01 November 2007, 12:31

Novell patches vulnerability in BorderManager 3.8 Client Trust

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

The Novell BorderManager 3.8 network administration software includes a Client Trust agent for network clients, in which a security vulnerability has been discovered by the Zero Day Initiative (ZDI). By default the agent listens on UDP port 3024 and accepts validation requests to this port. In the event of such a query, the client software copies a user-supplied name into a buffer until it encounters a wide char backslash or a null character. If neither of these is found, the application just keeps on copying. A buffer overflow occurs when the excess-length captured data is subsequently copied into a fixed size buffer. As a result it is possible to execute injected code. Valid credentials for the system are not required in order to exploit this vulnerability. Novell has released an update which fixes the vulnerability. Administrators should install the update as soon as possible.

See also:

(mba)

Print Version | Send by email | Permalink: http://h-online.com/-733894
 


  • July's Community Calendar





The H Open

The H Security

The H Developer

The H Internet Toolkit