CVE-2002-2096

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Buffer overflow in Novell Remote Manager module, httpstk.nlm, in NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary code via a long (1) username or (2) password.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2002-04/0001.htmlVendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-04/0088.htmlPatch
http://support.novell.com/servlet/tidfinder/2962026Patch, Vendor Advisory
http://www.iss.net/security_center/static/8736.phpPatch
http://www.securityfocus.com/bid/4405Patch
http://archives.neohapsis.com/archives/bugtraq/2002-04/0001.htmlVendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-04/0088.htmlPatch
http://support.novell.com/servlet/tidfinder/2962026Patch, Vendor Advisory
http://www.iss.net/security_center/static/8736.phpPatch
http://www.securityfocus.com/bid/4405Patch

Timeline

Published: Dec 31, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-20975.0The compression code in MaraDNS before 0.9.01 allows remote attackers to cause a denial of service via crafted DNS packets.CVE-2002-20987.5Buffer overflow in axspawn.c in Axspawn-pam before 0.2.1a allows remote attackers to execute arbitrary code via large packets.CVE-2002-20997.2Buffer overflow in the GNU DataDisplay Debugger (DDD) 3.3.1 allows local users to execute arbitrary code and possibly gain privileges via a CVE-2002-21005.0Microsoft Outlook 2002 allows remote attackers to embed bypass the file download restrictions for attachments via an HTML email message that CVE-2002-21017.5Microsoft Outlook 2002 allows remote attackers to execute arbitrary JavaScript code, even when scripting is disabled, via an "about:" or "ja CVE-2002-21025.0InfBlocks.java in JCraft JZlib before 0.0.7 allow remote attackers to cause a denial of service (NullPointerException) via an invalid block CVE-2002-21035.0Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-CVE-2002-21047.5graph.php in Ganglia PHP RRD Web Client 1.0.2 allows remote attackers to execute arbitrary commands via the command parameter, which is prov CVE-2002-21052.1Microsoft Windows XP allows local users to prevent the system from booting via a corrupt explorer.exe.manifest file.CVE-2002-21067.5PHP remote file inclusion vulnerability in WikkiTikkiTavi before 0.21 allows remote attackers to execute arbitrary PHP code via the Template CVE-2002-21074.3Cross-site scripting (XSS) vulnerability in the lookup script in Veridis OpenKeyServer (OKS) 1.2 allows remote attackers to inject arbitrary CVE-2002-21085.0Unknown vulnerability in the "VAIO Manual" software in certain Sony VAIO personal computers sold from November 2001 to January 2002, allows