CVE-2009-4654: Stack-based buffer overflow in the dhost module in Novell eDirectory 8.8 SP5 for Windows allows remote auth...

Security readout for executives and security teams

CVE-2009-4654 is a memory corruption flaw in Novell eDirectory 8.8 SP5 on Windows. A logged-in remote user could cause the dhost service to mishandle oversized password fields and potentially run attacker-controlled code. The source bundle does not name a vendor patch or current exploitation. Exposure is likely limited to organizations still running Novell eDirectory 8.8 SP5 on Windows with the affected HTTPSTK/dhost interface reachable by authenticated users. Internet exposure is not established in the source bundle. Prioritize if legacy eDirectory remains in production, especially where many users can authenticate or management services are broadly reachable. The business risk is server compromise, but confidence is reduced because source details are old and patch guidance is absent. Mitigation focus: Identify any Novell eDirectory 8.8 SP5 for Windows systems.; Check Micro Focus/OpenText or legacy Novell guidance for supported fixes.; Restrict HTTPSTK/dhost access to trusted administrative networks..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.