Critical severity · published Nov 12, 2008
CVE-2008-5038
Use-after-free vulnerability in the NetWare Core Protocol (NCP) feature in Novell eDirectory 8.7.3 SP10 before 8.7.3 SP10 FTF1 and 8.8 SP2 for Windows allows remote attackers to…
9.8
CVSS
6.2%
EPSS
No
On KEV
Description
Use-after-free vulnerability in the NetWare Core Protocol (NCP) feature in Novell eDirectory 8.7.3 SP10 before 8.7.3 SP10 FTF1 and 8.8 SP2 for Windows allows remote attackers to cause a denial of service and possibly execute arbitrary code via a sequence of "Get NCP Extension Information By Name" requests that cause one thread to operate on memory after it has been freed in another thread, which triggers memory corruption, aka Novell Bug 373852.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.2% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Edirectory · Novell
before 8.7.3; 8.7.3; 8.7.3; 8.7.3; 8.7.3; 8.7.3; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-5038
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-5038
Broken Link
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=748
Broken Link
http://osvdb.org/48206
Broken Link
http://secunia.com/advisories/32395
Broken Link
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037180.html
Broken Link
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037181.html
Broken Link
http://www.novell.com/support/viewContent.do?externalId=3426981
More from Edirectory
9.8
CVE-2002-2119
Novell eDirectory 8.6.2 and 8.7 use case insensitive passwords, which makes it easier for remote attackers to conduct brute force password guessing
7.5
CVE-2017-9277
The LDAP backend in Novell eDirectory before 9.0 SP4 when switched to EBA (Enhanced Background Authentication) kept open connections without EBA
7.5
CVE-2017-9267
In Novell eDirectory before 9.0.3.1 the LDAP interface was not strictly enforcing cipher restrictions allowing weaker ciphers to be used during SSL BIND operations
7.5
CVE-2017-5186
Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch 9 Hotfix 2, and NetIQ eDirectory 9.x before 9.0.2 Hotfix 2…
7.5
CVE-2016-9167
NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a privilege escalation by modifying user…