CVE-2006-5478

Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow remote attackers to execute arbitrary code via (1) a long HTTP Host header, which triggers an overflow in the BuildRedirectURL function; or vectors related to a username containing a . (dot) character in the (2) SMTP, (3) POP, (4) IMAP, (5) HTTP, or (6) Networked Messaging Application Protocol (NMAP) Netmail services.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

84.00% chance of exploitation in the next 30 days, 100th percentile

Published

2006-10-24

Updated

2024-08-07

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/edirectory_host.rb

ExploitDB entries (4)

• https://www.exploit-db.com/exploits/28837
• https://www.exploit-db.com/exploits/28836
• https://www.exploit-db.com/exploits/28835
• https://www.exploit-db.com/exploits/16773

References

• CVE Record
• NVD entry

Related

• CVE-2006-5472
• CVE-2006-5480
• CVE-2006-5471
• CVE-2006-5482
• CVE-2006-5458
• CVE-2006-5483