cbcvebase.
CVE-2008-0935
published 2008-02-25

CVE-2008-0935: Stack-based buffer overflow in the Novell iPrint Control ActiveX control in ienipp.ocx in Novell iPrint Client before 4.34 allows remote attackers to execute…

PriorityP260critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
65.14%
99.2th percentile
Stack-based buffer overflow in the Novell iPrint Control ActiveX control in ienipp.ocx in Novell iPrint Client before 4.34 allows remote attackers to execute arbitrary code via a long argument to the ExecuteRequest method.

Affected

3 ranges
VendorProductVersion rangeFixed in
novelliprint<= 4.32
novelliprint_client
novelliprint_client

Detection & IOCsextracted from sources · hover to see the quote

filenameienipp.ocx
commandExecuteRequest()
  • Monitor for ActiveX instantiation of ienipp.ocx (Novell iPrint Control) in browser processes, particularly when the ExecuteRequest method is called with an unusually long string argument.
  • The Metasploit exploit uses a heap-spray technique with a return address of 0x0A0A0A0A targeting Windows XP SP0-SP2 / Vista with IE 6/7; detect NOP sled heap spray patterns in browser memory or network content delivering this return address.
  • Exploit delivery is via a malicious HTML page served over HTTP containing obfuscated JavaScript with unescape() heap spray and an ActiveX object targeting ienipp.ocx; inspect HTTP responses for this pattern.
  • The exploit sets EXITFUNC to 'process', meaning the shellcode will terminate the browser process on exit; look for abnormal iexplore.exe termination following ActiveX method calls.
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.