VulnerabilityModified

CVE-2008-2431

HIGH 9.3EPSS 51.1%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 51.1%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

Multiple buffer overflows in Novell iPrint Client before 5.06 allow remote attackers to execute arbitrary code by calling the Novell iPrint ActiveX control (aka ienipp.ocx) with (1) a long third argument to the GetDriverFile method; a long first argument to the (2) GetPrinterURLList or (3) GetPrinterURLList2 method; (4) a long argument to the GetFileList method; a long argument to the (5) GetServerVersion, (6) GetResourceList, or (7) DeleteResource method, related to nipplib.dll; a long uploadPath argument to the (8) UploadPrinterDriver or (9) UploadResource method, related to URIs; (10) a long seventh argument to the UploadResource method; a long string in the (11) second, (12) third, or (13) fourth argument to the GetDriverSettings method, related to the IppGetDriverSettings function in nipplib.dll; or (14) a long eighth argument to the UploadResourceToRMS method.

CVSS 2.0: 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS: 51.05% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-119
Affected: novell/iprint
Source: PSIRT-CNA@flexerasoftware.com

References

http://secunia.com/advisories/30667Vendor Advisory
http://secunia.com/secunia_research/2008-27/advisory/Vendor Advisory
http://www.securityfocus.com/bid/30813
https://exchange.xforce.ibmcloud.com/vulnerabilities/44616
http://secunia.com/advisories/30667Vendor Advisory
http://secunia.com/secunia_research/2008-27/advisory/Vendor Advisory
http://www.securityfocus.com/bid/30813
https://exchange.xforce.ibmcloud.com/vulnerabilities/44616

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.