CVE-2013-3707: novell open_enterprise_server Improper Input Validation

Vulnerability summary

CVE-2013-3707 is a medium (CVSS 4.3) Improper Input Validation vulnerability in novell open_enterprise_server. EPSS estimates a 1.58% chance of exploitation in the next 30 days, higher than 75.1% of scored vulnerabilities.

Timeline

1. 01-12-2013
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The HTTPSTK service in the novell-nrm package before 2.0.2-297.305.302.3 in Novell Open Enterprise Server 2 (OES 2) Linux, and OES 11 Linux Gold and SP1, does not make the intended SSL_free and SSL_shutdown calls for the close of a TCP connection, which allows remote attackers to cause a denial of service (service crash) by establishing many TCP connections to port 8009.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.