From ereed@novell.com Thu Nov 14 19:22:44 2002 From: Ed Reed To: security-alerts@list.novell.com, bugtraq@securityfocus.com Date: Mon, 11 Nov 2002 10:50:24 -0700 Subject: NOVL-2002-2963651 - iManager (eMFrame) Buffer Overflow -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For Immediate Disclosure ============================== Summary ============================== Security Alert: NOVL-2002-2963651 Title: iManager (eMFrame) Buffer Overflow Date: 08-Oct-2002 Revision: Updates NOVL-2002-2963081 Product Name: iManager (eMFrame) OS/Platform(s): Netware 6 SP2 Reference URL: http://support.novell.com/servlet/tidfinder/2963651 Vendor Name: Novell, Inc. Vendor URL: http://www.novell.com Security Alerts: http://support.novell.com/security-alerts Affects: iManager (eMFrame) versions PRIOR TO 1.5 Identifiers: None Credits: None ============================ Description ============================ If Distinguished Name longer than 255 characters entered as user login name, a buffer overflow would terminate eMFrame. ============================== Impact =============================== The maximum length for the attribute DN in eDirectory 8.6 and above is 256 characters. While authenticating into eMFrame, if a DN with more than 256 characters are passed in by the user, eMFrame will terminate. ======================== Recommended Actions ======================== DO NOT APPLY THIS PATCH if iManager 1.5 has been previously installed. See detailed instructions in the referenced Technical Information Document (TID) http://support.novell.com/servlet/tidfinder/2963651. ============================ DISCLAIMER ============================= The content of this document is believed to be accurate at the time of publishing based on currently available information. However, the information is provided "AS IS" without any warranty or representation. Your use of the document constitutes acceptance of this disclaimer. Novell disclaims all warranties, express or implied, regarding this document, including the warranties of merchantability and fitness for a particular purpose. Novell is not liable for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this document or any security alert, even if Novell has been advised of the possibility of such damages and even if such damages are foreseeable. ============================ Appendices ============================= None ================ Contacting Novell Security Alerts ================== To report suspected security vulnerabilities in Novell products, send email to secure@novell.com or use the web form at our website http://support.novell.com/security-alerts PGP users may send signed/encrypted information to us using our PGP key, available from the pgpkeys.mit.edu server, or our website. Users wishing to be notified when Novell Security Alerts are issued may register their email address at http://www.novell.com/info/list/ Security Alerts, Novell, Inc. PGP Key Fingerprint: F5AE 9265 0A34 F84E 580E 9B87 3AC1 1974 DE05 0FDB ========================= Revision History ========================== Original: 12-Aug-2002 - Security Alert: NOVL-2002-2963081 Revision: 08-Oct-2002 - This Revision -----BEGIN PGP SIGNATURE----- Version: PGP Personal Security 7.0.3 iQA/AwUBPc/b3DrBGXTeBQ/bEQK6IwCfY2ipioQlSV2dAhzHINpy6sDsybQAoKps wKGA5bpaVjFSdDOajEAKeB5L =NrtQ -----END PGP SIGNATURE-----