OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Patrik Karlsson (patrik.karlssonse.pwcglobal.com)
Date: Wed May 08 2002 - 05:09:43 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    cqure.net Security Vulnerability Report
    No: cqure.net.20020412.bordermanager_36_mv1.a
    ==============================================

    Vulnerability Summary
    ---------------------
    Problem: Multiple vulnerabilities identified in
                       Novell Border Manager 3.6. During our brief
                       look at Novell Border Manager 3.6, we have
                       identified three issues within the product.
                       The vulnerabilities will cause the handling
                       NLM to abend, and in some cases result in a
                       DOS of the Novell server.

    Threat: An attacker could prevent legitimate use of
                       the Novell server, by sending special crafted
                       information to the server.

    Affected Software: Border Manager 3.6 SP 1a.

    Platform: Netware 6.0 SP 1 verified.

    Vulnerability Description
    -------------------------
    The first vulnerability is within the FTP-proxy server of BM 3.6.
    After issuing the connection request to the proxy an attacker could
    send a couple of megs of random data, which would cause the server
    to stop responding to tcp/ip for a while. The server will then start
    answering tcp/ip traffic again after 10 to 20 seconds. If this is
    repeated for ten times or so, our test environment stop responding
    to tcp/ip alltogether, and the server had to be rebooted to regain
    full functionability.

    The second vulnerability is in the ip/ipx gateway on tcp port 8225.
    If one would send approximately two megabytes of random data to this
    port, the nlm ipipxgw.nlm will abend.

    The third vulnerability is in the RTSP proxy running on port 9090.
    One could cause the proxy.nlm to abend by simply connecting to the
    port, issuing the command "GET" followed by six enters.

    Solution
    --------
    Filter incoming connections to the ports 21, 8225 and 9090. As soon
    as patches become available, apply them.

    Additional Information
    ----------------------
    Novell was contacted 20020412 and have been unable to reproduce the
    issues up until today.

    This vulnerability was found and researched by
    Patrik Karlsson & Jonas Lšndin
    patrik.karlssonse.pwcglobal.com
    jonas.landinixsecurity.com

    This document is also available at: http://www.cqure.net/advisories/