cbcvebase.
CVE-2010-1929
published 2010-06-28

CVE-2010-1929: Multiple stack-based buffer overflows in the jclient._Java_novell_jclient_JClient_defineClass@20 function in jclient.dll in the Tomcat web server in Novell…

PriorityP261critical9CVSS 2.0
AVNACLAuSCCICAC
EXPLOIT
EPSS
16.10%
96.6th percentile
Multiple stack-based buffer overflows in the jclient._Java_novell_jclient_JClient_defineClass@20 function in jclient.dll in the Tomcat web server in Novell iManager 2.7, 2.7.3, and 2.7.3 FTF2 allow remote authenticated users to execute arbitrary code via the (1) EnteredClassID or (2) NewClassName parameter to nps/servlet/webacc.

Affected

8 ranges
VendorProductVersion rangeFixed in
novellimanager<= 2.7.4—
novellimanager——
novellimanager——
novellimanager——
novellimanager——
novellimanager——
novellimanager——
novellimanager——

Detection & IOCsextracted from sources · hover to see the quote

url/nps/servlet/webacc/↗
path/nps/servlet/webacc↗
filenamejclient.dll↗
commandrank=primary&DoLogin=true&forceMaster=false&username=admin&password=mipass&tree=AAAA...&Entrada.x=27&Entrada.y=13↗
  • →Detect CVE-2010-1929 exploitation by monitoring POST requests to /nps/servlet/webacc/ where the 'EnteredClassID' or 'NewClassName' parameters exceed 32 characters in length (the server-side limit is not enforced, only client-side maxlength=32). ↗
  • →Detect CVE-2010-1930 (related DoS) by monitoring POST requests to /nps/servlet/webacc where the 'Tree' (or 'tree') parameter is exactly 256 characters long, which triggers an off-by-one crash in the iManager Tomcat web server. ↗
  • →The stack-based buffer overflow (CVE-2010-1929) is triggered by an authenticated user sending an overly long class name via POST to /nps/servlet/webacc/; the vulnerable code path is in jclient.dll function _Java_novell_jclient_JClient_defineClass, which performs an unchecked REP MOVS copy into a fixed-size stack buffer. ↗
  • →The vulnerability requires authentication (authenticated POST request); monitor for authenticated sessions sending abnormally large 'NewClassName' or 'EnteredClassID' values under the iManager 'Schema' menu create-class feature. ↗
  • →CVE-2011-4188 (related issue) targets the 'EnteredAttrName' parameter in the Create Attribute function of jclient; monitor POST requests to Novell iManager for oversized EnteredAttrName values as well. ↗
  • ·The class name length restriction (max 32 characters) is enforced only on the client side via HTML maxlength=32; there is no server-side validation, making WAF or Apache-level request filtering the only mitigation short of patching. ↗
  • ·Exploitation of CVE-2010-1929 requires an authenticated session; the attacker must have valid credentials to the iManager web console before triggering the overflow. ↗
  • ·Successful exploitation on iManager Server yields SYSTEM-level code execution, while on iManager Workstation it runs with the privileges of the current user. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.