* Potential denial of service exploit found in eDirectory
One of the benefits of NetWare and other Novell products has always been their security. Major security problems only seem to come along about once a decade, on average. So when a vulnerability does surface, it can seem much bigger than it really is. Last week Secunia reported a potential denial-of-service exploit that leverages a bug in eDirectory.
The full text of the warning is:
“A vulnerability has been reported in Novell eDirectory, which can be exploited by malicious people to cause a DoS. The vulnerability is caused due to a pointer handling error within the ‘BerDecodeLoginDataRequest()’ function in the libnmasldap.so module. This can be exploited to crash the process via a specially crafted login request. The vulnerability is reported in Novell eDirectory versions 8.8 and 8.8.1. Other versions may also be affected.”
What it means is that if someone knows the specific “login request” (and the implication is that this has to be done as code, not just as a username/password combination in a login box) they could cause eDirectory to crash rendering it unavailable for others to use for authentication, authorization or other purposes. There would most likely not be any damage and there’s little chance of a data breach.
If this were an Active Directory bug, it would be relatively unnoticed among all of the security problems that crop up seemingly daily in Windows. But because NetWare is so bug-free, it’s importance is magnified in the minds of some. It isn’t that important, but you should get the patch for it soon and install it at your first opportunity.
In some ways, after all, NetWare network managers may be less security conscious than their Windows counterparts simply because NetWare exploits are so few and far between.
*** Just as I was finishing up this newsletter last week, Novell announced it is making a pact with the devil. CEO Ron Hovsepian jumped on stage with
