cqure.net Security Vulnerability Report
No: cqure.net.20020412.bordermanager_36_mv1.a
==============================================
Vulnerability Summary
---------------------
Problem: Multiple vulnerabilities identified in
Novell Border Manager 3.6. During our brief
look at Novell Border Manager 3.6, we have
identified three issues within the product.
The vulnerabilities will cause the handling
NLM to abend, and in some cases result in a
DOS of the Novell server.
Threat: An attacker could prevent legitimate use of
the Novell server, by sending special crafted
information to the server.
Affected Software: Border Manager 3.6 SP 1a.
Platform: Netware 6.0 SP 1 verified.
Vulnerability Description
-------------------------
The first vulnerability is within the FTP-proxy server of BM 3.6.
After issuing the connection request to the proxy an attacker could
send a couple of megs of random data, which would cause the server
to stop responding to tcp/ip for a while. The server will then start
answering tcp/ip traffic again after 10 to 20 seconds. If this is
repeated for ten times or so, our test environment stop responding
to tcp/ip alltogether, and the server had to be rebooted to regain
full functionability.
The second vulnerability is in the ip/ipx gateway on tcp port 8225.
If one would send approximately two megabytes of random data to this
port, the nlm ipipxgw.nlm will abend.
The third vulnerability is in the RTSP proxy running on port 9090.
One could cause the proxy.nlm to abend by simply connecting to the
port, issuing the command "GET" followed by six enters.
Solution
--------
Filter incoming connections to the ports 21, 8225 and 9090. As soon
as patches become available, apply them.
Additional Information
----------------------
Novell was contacted 20020412 and have been unable to reproduce the
issues up until today.
This vulnerability was found and researched by
Patrik Karlsson & Jonas Ländin
patrik.karlssonat_private
jonas.landinat_private
This document is also available at: http://www.cqure.net/advisories/
This archive was generated by hypermail 2b30 : Wed May 08 2002 - 12:16:45 PDT