Novell iPrint Client ActiveX Control ExecuteRequest debug buffer overflow

Added: 08/16/2010
BID: 42100
OSVDB: 66960

Background

Novell iPrint is an application which allows users to install and manage printers. Novell iPrint installs the Novell iPrint Control ActiveX control named ienipp.ocx.

Problem

A buffer overflow vulnerability in ienipp.ocx allows command execution when a user loads a web page which calls the ExecuteRequest method with a specially crafted debug parameter.

Resolution

Upgrade to iPrint Client 5.42 or higher.

References

http://dvlabs.tippingpoint.com/advisory/TPTI-10-06

Limitations

Exploit works on Novell iPrint Client 5.40 and requires a user to open the exploit page in Internet Explorer 6 or 7.

Platforms

Windows XP

Back to exploit index