Signature Detail

APP: Novell iManager Class Name Remote Buffer Overflow

This signature detects attempts to exploit a known buffer overflow vulnerability in Novell iManager. It is due to insufficient validation of the class name parameter when handling HTTP requests sent to the "/nps/servlet/webacc/" module. A remote authenticated attackers can exploit this on the target server by sending a crafted HTTP POST request. A successful attack can result in arbitrary code execution with SYSTEM privileges.

Extended Description

Novell iManager is prone to a stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Attackers may exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will completely compromise affected computers. Failed exploit attempts will result in a denial-of-service condition. Versions prior to Novell iManager 2.7.4 are vulnerable.

Affected Products

• Novell iManager 2.0.0
• Novell iManager 2.0.2
• Novell iManager 2.5.0
• Novell iManager 2.6.0
• Novell iManager 2.7.0
• Novell iManager 2.7.1
• Novell iManager 2.7.2
• Novell iManager 2.7.3
• Novell iManager 2.7.3 FTF2

References

• BugTraq: 40480
• CVE: CVE-2010-1929
• URL: http://secunia.com/advisories/40281