Vulnerability Details : CVE-2008-5038
Use-after-free vulnerability in the NetWare Core Protocol (NCP) feature in Novell eDirectory 8.7.3 SP10 before 8.7.3 SP10 FTF1 and 8.8 SP2 for Windows allows remote attackers to cause a denial of service and possibly execute arbitrary code via a sequence of "Get NCP Extension Information By Name" requests that cause one thread to operate on memory after it has been freed in another thread, which triggers memory corruption, aka Novell Bug 373852.
Vulnerability category: Memory CorruptionExecute codeDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2008-5038
Probability of exploitation activity in the next 30 days: 22.97%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 96 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2008-5038
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2008-5038
-
Assigned by: nvd@nist.gov (Primary)
-
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-5038
-
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037181.html
HTTP 404 Page Not FoundBroken Link;Patch
-
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=748
Broken Link
-
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037180.html
HTTP 404 Page Not FoundBroken Link;Patch;Vendor Advisory
-
http://www.vupen.com/english/advisories/2008/2937
Webmail: access your OVH emails on ovhcloud.com | OVHcloudBroken Link;Vendor Advisory
-
http://www.novell.com/support/viewContent.do?externalId=3426981
History of Issues Resolved in eDirectory 8.8.xBroken Link
-
http://www.securitytracker.com/id?1021117
Broken Link;Third Party Advisory;VDB Entry
-
http://secunia.com/advisories/32395
About Secunia Research | FlexeraBroken Link;Vendor Advisory
-
http://www.securityfocus.com/bid/31956
Broken Link;Third Party Advisory;VDB Entry
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/46138
Novell eDirectory NCP engine code execution CVE-2008-5038 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://osvdb.org/48206
Broken Link
Products affected by CVE-2008-5038
- cpe:2.3:a:novell:edirectory:*:*:*:*:*:*:*:*
- cpe:2.3:a:novell:edirectory:8.7.3:sp1:*:*:*:windows:*:*
- cpe:2.3:a:novell:edirectory:8.7.3:sp2:*:*:*:windows:*:*
- cpe:2.3:a:novell:edirectory:8.7.3:sp3:*:*:*:windows:*:*
- cpe:2.3:a:novell:edirectory:8.7.3:sp4:*:*:*:windows:*:*
- cpe:2.3:a:novell:edirectory:8.7.3:sp5:*:*:*:windows:*:*
- cpe:2.3:a:novell:edirectory:8.7.3:sp6:*:*:*:windows:*:*
- cpe:2.3:a:novell:edirectory:8.7.3:sp7:*:*:*:windows:*:*
- cpe:2.3:a:novell:edirectory:8.7.3:sp8:*:*:*:windows:*:*
- cpe:2.3:a:novell:edirectory:8.7.3:sp9:*:*:*:windows:*:*
- cpe:2.3:a:novell:edirectory:8.8:-:*:*:*:windows:*:*