CVE-2012-0432: NetIQ eDirectory NCP stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 score of 10 with a network, unauthenticated vector and a 99th-percentile EPSS score make this a top remediation priority despite thin exploit detail.

What it is

NetIQ eDirectory 8.8.7.x before 8.8.7.2 contains a stack-based buffer overflow in its Novell NCP implementation. The flaw is remotely reachable over the network with no authentication, and the record does not specify the exact vectors or the resulting impact beyond 'unspecified'.

Impact

An unauthenticated remote attacker could corrupt stack memory in the eDirectory NCP service, potentially leading to code execution or a denial of service. The record does not state the precise impact, so the full consequence is unconfirmed.

Attack surface

Reached over the network via the NCP protocol implementation in eDirectory, per the AV:N/AC:L/Au:N vector. No authentication or user interaction is required.

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is 0.587 (99th percentile), indicating high predicted exploitation activity despite the absence of confirmed public exploits in this record.

What to do

• Upgrade eDirectory to 8.8.7.2 or later, which is the fixed version named in the description.
• Restrict network access to NCP ports to trusted hosts and segments until patching is complete.
• Monitor Novell support KB 3426981 and Bugzilla 785272 for vendor guidance and any updated fixed versions.
• Segment or isolate eDirectory servers that must expose NCP to untrusted networks.

Detection

• Monitor eDirectory NCP service processes for crashes or abnormal termination that could indicate malformed packet handling.
• Inspect network traffic to NCP ports for oversized or malformed requests targeting the eDirectory service.
• Correlate host and network logs for repeated unauthenticated NCP connection attempts from unexpected sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.