CVE-2008-0926
Novell eDirectory < 8.7.3.10 - Unauthenticated Denial of Service and Arbitrary File Read via SOAP Interface
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-0926.
PoCs published by Nicholas Gregorie, Nicob, MC, sinn3r, including Metasploit module auxiliary/admin/edirectory/edirectory_edirutil.
AI-analyzed exploit summary The provided code is a writeup describing a vulnerability in Novell eDirectory, with instructions on how to use a Java-based client to exploit it. It lacks actual exploit code but provides details on affected versions and basic usage.
Description
The SOAP interface to the eMBox module in Novell eDirectory 8.7.3.9 and earlier, and 8.8.x before 8.8.2, relies on client-side authentication, which allows remote attackers to bypass authentication via requests for /SOAP URIs, and cause a denial of service (daemon shutdown) or read arbitrary files. NOTE: it was later reported that 8.7.3.10 (aka 8.7.3 SP10) is also affected.
Exploits (2)
The provided code is a writeup describing a vulnerability in Novell eDirectory, with instructions on how to use a Java-based client to exploit it. It lacks actual exploit code but provides details on affected versions and basic usage.
This Metasploit module exploits an unauthenticated file access vulnerability in Novell eDirectory's eMBox service via SOAP interface. It allows various actions such as reading logs, listing services, and stopping/starting services.