CVE-2006-5478
Novell eDirectory 8.x-8.8.x - Remote Code Execution via Long HTTP Host Header or Dot in Username
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2006-5478.
PoCs published by Metasploit, MC, Expanders, including Metasploit module exploits/windows/http/edirectory_host.
AI-analyzed exploit summary This exploit targets a stack buffer overflow in Novell eDirectory 8.8.1 via an overly long HTTP Host header. It leverages SEH overwrites to achieve remote code execution on Windows systems.
Description
Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow remote attackers to execute arbitrary code via (1) a long HTTP Host header, which triggers an overflow in the BuildRedirectURL function; or vectors related to a username containing a . (dot) character in the (2) SMTP, (3) POP, (4) IMAP, (5) HTTP, or (6) Networked Messaging Application Protocol (NMAP) Netmail services.
Exploits (5)
This exploit targets a stack buffer overflow in Novell eDirectory 8.8.1 via an overly long HTTP Host header. It leverages SEH overwrites to achieve remote code execution on Windows systems.
This exploit targets a stack-based buffer overflow in Novell eDirectory's iMonitor web interface via an overly long HTTP Host header. It leverages SEH overwrites to execute arbitrary code with administrative privileges.
This exploit targets a stack-based buffer overflow in Novell eDirectory's iMonitor (CVE-2006-5478) to achieve remote code execution. It uses a reverse shell payload and overwrites the Second Exception Handler for control flow manipulation.
This exploit targets a stack-based buffer overflow in Novell eDirectory 8.8 NDS Server iMonitor. It sends a maliciously crafted HTTP request with an oversized 'Host' header containing a return address and shellcode to achieve remote code execution.
This Metasploit module exploits a stack buffer overflow in Novell eDirectory 8.8.1 via an overly long HTTP Host header, leading to remote code execution. It uses SEH overwrites and a custom payload to achieve exploitation.