cbcvebase.
CVE-2009-1568
published 2009-12-08

CVE-2009-1568: Stack-based buffer overflow in ienipp.ocx in Novell iPrint Client 5.30, and possibly other versions before 5.32, allows remote attackers to execute arbitrary…

PriorityP260critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
32.17%
98.1th percentile
Stack-based buffer overflow in ienipp.ocx in Novell iPrint Client 5.30, and possibly other versions before 5.32, allows remote attackers to execute arbitrary code via a long target-frame parameter.

Affected

2 ranges
VendorProductVersion rangeFixed in
novelliprint_client——
novelliprint_client——

Detection & IOCsextracted from sources · hover to see the quote

filenameienipp.ocx↗
other0x100489ac↗
  • →Monitor ActiveX control ienipp.ocx for invocations where the 'target-frame' parameter contains an abnormally long string (overflow payload); the 'operation' parameter must also be set to a valid command to reach the vulnerable code path. ↗
  • →The Metasploit module targets a pop/pop/ret gadget at offset 0x100489ac inside ienipp.ocx v5.30; presence of this return address in memory or network shellcode buffers is a strong indicator of exploitation. ↗
  • →Payload space is 1456 bytes with null bytes as bad characters; look for heap/stack spray patterns of ~1456 bytes with no null bytes delivered via browser to ienipp.ocx. ↗
  • →EXITFUNC is set to 'process', meaning the shellcode will terminate the process on exit; post-exploitation process termination of the browser process may be an indicator. ↗
  • ·The vulnerability is only reachable when the 'operation' parameter is set to a valid iPrint command; exploit attempts with an invalid or missing 'operation' value will not trigger the overflow. ↗
  • ·The ROP/return address gadget (0x100489ac) is specific to ienipp.ocx version 5.30; exploits targeting other versions will use a different return address. ↗
  • ·Affected versions are Novell iPrint Client 5.30 and possibly other versions before 5.32; versions 5.32 and later are not listed as vulnerable. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.