CVE-2008-5038: Use-after-free vulnerability in the NetWare Core Protocol (NCP) feature in Novell eDirectory 8.7.3 SP10 bef...

Security readout for executives and security teams

This flaw affects Novell eDirectory on Windows when its NetWare Core Protocol feature handles repeated extension information requests. A remote attacker could crash the directory service and may be able to execute code. For organizations still running these legacy versions, the business risk is service disruption to identity or directory-dependent systems. Exposure is likely limited to legacy Novell eDirectory deployments on Windows with NCP reachable by untrusted or semi-trusted networks. The bundle names eDirectory 8.7.3 SP10 before 8.7.3 SP10 FTF1 and 8.8 SP2 for Windows; it does not provide a complete affected CPE list. Prioritize remediation if eDirectory still supports authentication, directory, or application dependencies. The flaw is old, but remote denial of service against identity infrastructure can still be business-critical when legacy systems remain exposed. Mitigation focus: Inventory Novell eDirectory for Windows versions and enabled NCP exposure.; Apply the Novell-supported fixed release or field test file named in vendor guidance.; Restrict NCP access to trusted management and application networks only..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.