Environment
Novell eDirectory 8.8 and prior for All Platforms
Novell eDirectory 8.7.3.9 and prior for All Platforms
Situation
The eMBox utility is vulnerable to unauthenticated attacks.
Successful exploit of this vulnerability could result in DoS or
access to local files.
Resolution
For eDirectory 8.8.X
Apply eDirectory 8.8.2
For eDirectory 8.7.3.X
Unloading the embox module will prevent edirutil from being able to connect and exploit the ability to perform unauthenticated tasks.
To prevent the module from loading:
On NetWare:
Rename the SYS:\SYSTEM\EMBOX.NLM
On Solaris/Linux:
Rename the /usr/lib/nds-modules/libembox.so.1.0.0 and remove the embox entry in the /usr/lib/nds-modules/ndsmodules.conf.
On Windows:
Rename the c:\novell\nds\embox.dlm and set the embox service in the eDirectory Services to manually start.
Apply eDirectory 8.8.2
For eDirectory 8.7.3.X
Unloading the embox module will prevent edirutil from being able to connect and exploit the ability to perform unauthenticated tasks.
To prevent the module from loading:
On NetWare:
Rename the SYS:\SYSTEM\EMBOX.NLM
On Solaris/Linux:
Rename the /usr/lib/nds-modules/libembox.so.1.0.0 and remove the embox entry in the /usr/lib/nds-modules/ndsmodules.conf.
On Windows:
Rename the c:\novell\nds\embox.dlm and set the embox service in the eDirectory Services to manually start.
Status
Security AlertTop Issue
Additional Information
This vulnerability was reported by Nicholas Gregorie
CVE-2008-0926
CVE-2008-0926