CVE-2008-5038

Severity CVSS v4.0:

Pending analysis

Type:

CWE-416 Use After Free

Publication date:

12/11/2008

Last modified:

09/04/2025

Description

Use-after-free vulnerability in the NetWare Core Protocol (NCP) feature in Novell eDirectory 8.7.3 SP10 before 8.7.3 SP10 FTF1 and 8.8 SP2 for Windows allows remote attackers to cause a denial of service and possibly execute arbitrary code via a sequence of "Get NCP Extension Information By Name" requests that cause one thread to operate on memory after it has been freed in another thread, which triggers memory corruption, aka Novell Bug 373852.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 9.80 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

9.80

Severity 3.x

CRITICAL

Vector 2.0

AV:N/AC:L/Au:N/C:C/I:C/A:C CVSS v2.0 Severity and Metrics:

Base Score: 10.00 HIGH
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Attack Vector (AV): Network
Attack Complexity (AC): Low
Authentication (Au): None
Confidentiality (C): Complete
Integrity (I): Complete
Availability (A): Complete

Base Score 2.0

10.00

Severity 2.0

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:novell:edirectory::::::::		8.7.3 (excluding)
cpe:2.3:a:novell:edirectory:8.7.3:sp1::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp2::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp3::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp4::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp5::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp6::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp7::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp8::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp9::::windows::*
cpe:2.3:a:novell:edirectory:8.8:-::::windows::*

To consult the complete list of CPE names with products and versions, see this page

CPE	From	Up to
cpe:2.3:a:novell:edirectory::::::::		8.7.3 (excluding)
cpe:2.3:a:novell:edirectory:8.7.3:sp1::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp2::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp3::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp4::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp5::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp6::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp7::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp8::::windows::*
cpe:2.3:a:novell:edirectory:8.7.3:sp9::::windows::*
cpe:2.3:a:novell:edirectory:8.8:-::::windows::*

CVE-2008-5038

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools