CVE-2008-0935
published 2008-02-25CVE-2008-0935: Stack-based buffer overflow in the Novell iPrint Control ActiveX control in ienipp.ocx in Novell iPrint Client before 4.34 allows remote attackers to execute…
PriorityP260critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
65.14%
99.2th percentile
Stack-based buffer overflow in the Novell iPrint Control ActiveX control in ienipp.ocx in Novell iPrint Client before 4.34 allows remote attackers to execute arbitrary code via a long argument to the ExecuteRequest method.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| novell | iprint | <= 4.32 | — |
| novell | iprint_client | — | — |
| novell | iprint_client | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for ActiveX instantiation of ienipp.ocx (Novell iPrint Control) in browser processes, particularly when the ExecuteRequest method is called with an unusually long string argument. ↗
- →The Metasploit exploit uses a heap-spray technique with a return address of 0x0A0A0A0A targeting Windows XP SP0-SP2 / Vista with IE 6/7; detect NOP sled heap spray patterns in browser memory or network content delivering this return address. ↗
- →Exploit delivery is via a malicious HTML page served over HTTP containing obfuscated JavaScript with unescape() heap spray and an ActiveX object targeting ienipp.ocx; inspect HTTP responses for this pattern. ↗
- →The exploit sets EXITFUNC to 'process', meaning the shellcode will terminate the browser process on exit; look for abnormal iexplore.exe termination following ActiveX method calls. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
ARYADAD - Multiple Vulnerabilities
exploitdb·2012-01-21
CVE-2012-0935 ARYADAD - Multiple Vulnerabilities
ARYADAD - Multiple Vulnerabilities
---
#
# Title : ARYADAD Multi Vulnerability
# Author : Red Security TEAM
# Date : 21/01/2012
# Vendor : http://cms.aryadad.com/
# Tested On : Windows Server 2008 (IIS 7.5)
# Dork : Powered by ARYADAD Corporation
# Contact : Info [ 4t ] RedSecurity [ d0t ] COM
# Home : http://RedSecurity.COM
#
# Exploit :
#
# I : Blind SQL Injection Vulnerability
# True : http://server/Default.aspx?PageID=117' and 1-1 = '0
# False : http://server/Default.aspx?PageID=117' and 2-1 = '0
#
# II : File Upload Vulnerability
# 1. Go to : /FA/fckeditor/editor/filemanager/connectors/test.html
# 2. Set Connector To ASP.Net and upload your file , You can see your uploaded files in FA/userfiles/file/
#
Exploit-DB
Novell iPrint Client - ActiveX Control ExecuteRequest Buffer Overflow (Metasploit)
exploitdb·2010-09-21
CVE-2008-0935 Novell iPrint Client - ActiveX Control ExecuteRequest Buffer Overflow (Metasploit)
Novell iPrint Client - ActiveX Control ExecuteRequest Buffer Overflow (Metasploit)
---
##
# $Id: novelliprint_executerequest.rb 10429 2010-09-21 18:46:29Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Novell iPrint Client ActiveX Control ExecuteRequest Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in Novell iPrint Client 4.26. When
sending an overly long string to the ExecuteRequest() property of ienipp.ocx
an attacker may be able to execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author
Metasploit
Novell iPrint Client ActiveX Control ExecuteRequest Buffer Overflow
metasploit
Novell iPrint Client ActiveX Control ExecuteRequest Buffer Overflow
Novell iPrint Client ActiveX Control ExecuteRequest Buffer Overflow
This module exploits a stack buffer overflow in Novell iPrint Client 4.26. When sending an overly long string to the ExecuteRequest() property of ienipp.ocx an attacker may be able to execute arbitrary code.
No writeups or analysis indexed.
http://download.novell.com/Download?buildid=prBBH4JpImA~http://secunia.com/advisories/27994http://www.securityfocus.com/bid/27939http://www.securitytracker.com/id?1019489http://www.vupen.com/english/advisories/2008/0639http://download.novell.com/Download?buildid=prBBH4JpImA~http://secunia.com/advisories/27994http://www.securityfocus.com/bid/27939http://www.securitytracker.com/id?1019489http://www.vupen.com/english/advisories/2008/0639
2008-02-25
Published