Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Novell eDirectory can run attacker code via SOAP header

CVE-2008-4479 · published 18 years ago
Summary

Versions of Novell eDirectory before 8.8.3 and 8.7.3.10 have a flaw in the dhost.exe component that can be triggered by a specially crafted SOAP request containing a long Accept-Language header. An attacker could use this to run their own code on the server, potentially taking control of the system. Apply the vendor’s security update or upgrade to a patched version as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
novell edirectory >= 8.7.3, < 8.7.3.10
>= 8.8, < 8.8.3
cpe:2.3:a:novell:edirectory:*:*:*:*:*:*:*:*
Original advisory text
Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.8 before 8.8.3, and 8.7.3 before 8.7.3.10 ftf1, allows remote attackers to execute arbitrary code via a SOAP request with a long Accep...
Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.8 before 8.8.3, and 8.7.3 before 8.7.3.10 ftf1, allows remote attackers to execute arbitrary code via a SOAP request with a long Accept-Language header.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
10% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published14 Oct 2008
Updated16 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-4479 · NVD
Track software like this
Free during beta