CVE-2008-0927

published 2008-04-14

CVE-2008-0927: dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with (1)…

Priority P3 39 medium 5 CVSS 2.0

AV N AC L Au N C N I N A P

EXPLOIT

dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with (1) multiple Connection headers or (2) a Connection header with multiple comma-separated values. NOTE: this might be similar to CVE-2008-1777.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	windows-nt	—	—
microsoft	windows-nt	—	—

Detection & IOCs extracted from sources · hover to see the quote

process dhost.exe↗

port TCP/8028↗

port TCP/8030↗

command (echo "GET / HTTP/1.0"; echo "Connection: foo"; echo "Connection: bar"; echo; echo) | nc -vn 192.168.1.1 8028↗

command (echo "GET / HTTP/1.0"; echo "Connection: foo, bar"; echo; echo) | nc -vn 192.168.1.1 8028↗

• → Detect HTTP requests to Novell eDirectory dhost.exe service (TCP/8028 or TCP/8030) containing multiple 'Connection:' headers in a single request, which triggers 100% CPU consumption. ↗
• → Detect HTTP requests to Novell eDirectory dhost.exe service (TCP/8028 or TCP/8030) containing a single 'Connection:' header with multiple comma-separated values, which triggers 100% CPU consumption. ↗
• → Monitor dhost.exe process for sustained 100% CPU utilization; multiple exploit requests can lock every CPU core on the host. ↗

• · The vulnerable service listens on non-standard HTTP/HTTPS ports (8028 and 8030); ensure network monitoring and IDS/IPS rules cover these ports, not just standard ports 80/443. ↗
• · Both eDirectory 8.7.3 (before SP10) and 8.8.2 are affected; patching to 8.7.3 SP10 or later is required to remediate. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-399