CVE-2006-5854
published 2006-12-03CVE-2006-5854: Multiple buffer overflows in the Spooler service (nwspool.dll) in Novell Netware Client 4.91 through 4.91 SP2 allow remote attackers to execute arbitrary code…
PriorityP352high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
57.29%
99.0th percentile
Multiple buffer overflows in the Spooler service (nwspool.dll) in Novell Netware Client 4.91 through 4.91 SP2 allow remote attackers to execute arbitrary code via a long argument to the (1) EnumPrinters and (2) OpenPrinter functions.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| novell | client | — | — |
| novell | netware_client | — | — |
| shaffer_solutions_corp | dapcnfsd.dll | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x2b\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe6\xc0\xc6\x10\x83\xeb\xfc\xe2\xf4\x1a\xaa\x2d\x5d\x0e\x39\x39\xef
- →The exploit triggers the vulnerability by calling EnumPrintersA with an oversized argument via the nwspool.dll Spooler provider; monitor for abnormally large arguments to EnumPrinters/OpenPrinter RPC calls directed at the Spooler service. ↗
- →The exploit connects to the spooler via the LPC port \RPC Control\spoolss and maps shared memory; detect unexpected LPC connections to this port from non-system processes. ↗
- →Post-exploitation, the shellcode opens a bind shell on TCP port 51477; alert on unexpected listening sockets on port 51477 or outbound connections to it on the affected host. ↗
- →Exploitation results in spoolsv.exe spawning a child process running as NT AUTHORITY\SYSTEM; monitor spoolsv.exe for unexpected child process creation (e.g., cmd.exe). ↗
- ·The exploit targets nwspool.dll only when it is registered as a printer provider; the vulnerability is only exploitable if the Novell Client printer provider is present in the registry key for Print\Providers. ↗
- ·The exploit code notes Novell nwspool.dll support as 'untested', meaning real-world exploitation behavior may differ from the PoC output shown. ↗
- ·The attack is delivered via RPC requests; remote, anonymous attackers may exploit this issue via RPC requests against Novell Client 4.91 through 4.91 SP2. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mwg2-x42f-3jxf: Multiple stack-based buffer overflows in the Spooler service (nwspool
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2007-2954 [HIGH] CWE-119 GHSA-mwg2-x42f-3jxf: Multiple stack-based buffer overflows in the Spooler service (nwspool
Multiple stack-based buffer overflows in the Spooler service (nwspool.dll) in Novell Client 4.91 SP2 through SP4 for Windows allow remote attackers to execute arbitrary code via certain long arguments to the (1) RpcAddPrinterDriver, (2) RpcGetPrinterDriverDirectory, and other unspecified RPC requests, aka Novell bug 300870, a different vulnerability than CVE-2006-5854.
GHSA
GHSA-4jmj-xq3w-8f72: Stack-based buffer overflow in the EnumPrinters function in the Spooler service (nwspool
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2008-0639 [HIGH] CWE-119 GHSA-4jmj-xq3w-8f72: Stack-based buffer overflow in the EnumPrinters function in the Spooler service (nwspool
Stack-based buffer overflow in the EnumPrinters function in the Spooler service (nwspool.dll) in Novell Client 4.91 SP2, SP3, and SP4 for Windows allows remote attackers to execute arbitrary code via a crafted RPC request, aka Novell bug 353138, a different vulnerability than CVE-2006-5854. NOTE: this issue exists because of an incomplete fix for CVE-2007-6701.
GHSA
GHSA-6j7x-gf8c-m9m3: Multiple buffer overflows in the Spooler service (nwspool
ghsa_unreviewed·2022-05-01
CVE-2006-5854 [HIGH] GHSA-6j7x-gf8c-m9m3: Multiple buffer overflows in the Spooler service (nwspool
Multiple buffer overflows in the Spooler service (nwspool.dll) in Novell Netware Client 4.91 through 4.91 SP2 allow remote attackers to execute arbitrary code via a long argument to the (1) EnumPrinters and (2) OpenPrinter functions.
GHSA
GHSA-q297-rgwf-h4xj: Buffer overflow in the EnumPrintersA function in dapcnfsd
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2007-0641 [HIGH] GHSA-q297-rgwf-h4xj: Buffer overflow in the EnumPrintersA function in dapcnfsd
Buffer overflow in the EnumPrintersA function in dapcnfsd.dll 0.6.4.0 in Shaffer Solutions (SSC) DiskAccess NFS Client allows remote attackers to execute arbitrary code via a long argument, an issue similar to CVE-2006-5854 and CVE-2007-0444.
No detection rules found.
Exploit-DB
Multiple Printer Providers (Spooler Service) - Local Privilege Escalation
exploitdb·2007-01-29·CVSS 7.5
CVE-2006-5854 [HIGH] Multiple Printer Providers (Spooler Service) - Local Privilege Escalation
Multiple Printer Providers (Spooler Service) - Local Privilege Escalation
---
/********************Private exploit- internal use only*****************
Title: Universal exploit for vulnerable printer providers (spooler service).
Vulnerability: Insecure EnumPrintersW() calls
Author: Andres Tarasco Acuña - [email protected]
Website: http://www.514.es
This code should allow to gain SYSTEM privileges with the following software:
blink !blink! blink!
- DiskAccess NFS Client (dapcnfsd.dll v0.6.4.0) - REPORTED & NOTFIXED -0day!!!
- Citrix Metaframe - cpprov.dll - FIXED
- Novell (nwspool.dll - CVE-2006-5854 - untested)
- More undisclosed stuff =)
If this code crashes your spooler service (spoolsv.exe) check your
"vulnerable" printer providers at:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Cont
Exploit-DB
SSC DiskAccess NFS Client - 'DAPCNFSD.dll' Remote Stack Buffer Overflow
exploitdb·2007-01-29·CVSS 7.5
CVE-2007-0641 [HIGH] SSC DiskAccess NFS Client - 'DAPCNFSD.dll' Remote Stack Buffer Overflow
SSC DiskAccess NFS Client - 'DAPCNFSD.dll' Remote Stack Buffer Overflow
---
// source: https://www.securityfocus.com/bid/22301/info
Shaffer Solutions Corp DiskAccess is prone to a stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary code within the context of the Spooler service. The Spooler service typically runs with the privileges of the 'LocalSystem' account.
/********************Private exploit- internal use only*****************
Title: Universal exploit for vulnerable printer providers (spooler service).
Vulnerability: Insecure EnumPrintersW() calls
Author: Andres Tarasco Acu�a - [email protected]
Website: http://ww
Exploit-DB
Novell Client 4.91 - 'NWSPOOL.dll' Remote Buffer Overflow
exploitdb·2006-11-21·CVSS 7.5
CVE-2006-5854 [HIGH] Novell Client 4.91 - 'NWSPOOL.dll' Remote Buffer Overflow
Novell Client 4.91 - 'NWSPOOL.dll' Remote Buffer Overflow
---
// source: https://www.securityfocus.com/bid/21220/info
Novell Client is prone to a remote buffer-overflow vulnerability. Successful exploits may result in a denial-of-service condition or arbitrary code execution. Remote, anonymous attackers may exploit this issue via RPC requests.
This issue affects Novell Client 4.91; other versions may also be vulnerable.
/********************Private exploit- internal use only*****************
Title: Universal exploit for vulnerable printer providers (spooler service).
Vulnerability: Insecure EnumPrintersW() calls
Author: Andres Tarasco Acu�a - [email protected]
Website: http://www.514.es
This code should allow to gain SYSTEM privileges with the following software:
blink !blink! blink!
No writeups or analysis indexed.
http://secunia.com/advisories/23027http://securitytracker.com/id?1017263http://securitytracker.com/id?1017315http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974765.htmhttp://www.kb.cert.org/vuls/id/300636http://www.kb.cert.org/vuls/id/653076http://www.novell.com/support/search.do?cmd=displayKC&externalId=3125538&sliceId=SAL_Publichttp://www.securityfocus.com/archive/1/453012/100/0/threadedhttp://www.securityfocus.com/bid/21220http://www.securityfocus.com/data/vulnerabilities/exploits/testlpc.chttp://www.vupen.com/english/advisories/2006/4631http://www.zerodayinitiative.com/advisories/ZDI-06-043.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/30461http://secunia.com/advisories/23027http://securitytracker.com/id?1017263http://securitytracker.com/id?1017315http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974765.htmhttp://www.kb.cert.org/vuls/id/300636http://www.kb.cert.org/vuls/id/653076http://www.novell.com/support/search.do?cmd=displayKC&externalId=3125538&sliceId=SAL_Publichttp://www.securityfocus.com/archive/1/453012/100/0/threadedhttp://www.securityfocus.com/bid/21220http://www.securityfocus.com/data/vulnerabilities/exploits/testlpc.chttp://www.vupen.com/english/advisories/2006/4631http://www.zerodayinitiative.com/advisories/ZDI-06-043.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/30461
2006-12-03
Published