-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 10.16.02: http://www.idefense.com/advisory/10.16.02.txt Denial of Service in Sabre Desktop Reservation Client for Windows October 16, 2002 I. BACKGROUND Sabre Inc.’s Desktop Reservation Software for Windows is a legacy travel agency program that has since been replaced by Sabre eVoya software. However, several travel agencies and major airline travel call centers still use this software. II. DESCRIPTION Sabre Desktop Reservation Software for Windows has a component called Sabserv (listening on TCP port 1001) that connects the client application to the communication components and eventually to the local Sabre gateway at the local site. If Sabserv is sent arbitrary data on TCP port 1001 that it does not understand, it will stop functioning within one minute, usually. The client application will no longer have access to Sabre or the gateway. The gateway application is unaffected by this vulnerability and all other users on the local system will continue to have connectivity. III. ANALYSIS Local exploitation at an airline call center or travel agency could potentially slow or halt production. Under heavy load, the client will lock up, thereby forcing a reboot. This causes a loss of productivity, particularly in a high-volume call center. Automated ticketing systems running this client can be crashed as well. Since some companies using this software may not regularly monitor such events, they could miss ticketing deadlines, thereby having to pay out of pocket for ticket price changes or penalties IV. DETECTION This issue was tested on Sabre Desktop Reservation Software for Windows 4.2, 4.3, and 4.4 on Windows 95 and 98SE, with all the latest patches installed. V. RECOVERY Restarting the application should restore normal functionality. VI. VENDOR FIX/RESPONSE Sabre responded with the following statement: "Sabserv will be updated to ignore data it does not understand as part of the next maintenance upgrade to Sabre Desktop Reservation Software for Windows. This will prevent the denial of service condition within the client application when arbitrary data is sent to port 1001." VII. CVE INFORMATION The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project has assigned the identification number CAN-2002-1191 to this issue. VIII. DISCLOSURE TIMELINE 07/26/2002 Issue disclosed to iDEFENSE 08/26/2002 Disclosed to vendor via e-mail to supportat_private 08/26/2002 Disclosed to iDEFENSE clients 09/03/2002 Second attempt at e-mail contact 09/15/2002 Call to Sabre technical support rep N2H, referred to customer support representative 09/20/2002 Fourth attempt at contact (leslie.priceat_private) 09/23/2002 Response received from Leslie Price 09/23/2002 Response received from Jeff Harmon (jeff.harmonat_private) 10/10/2002 Coordinated public disclosure IX. CREDIT Altomo (adame780at_private) is credited with discovering this vulnerability. Get paid for security research http://www.idefense.com/contributor.html Subscribe to iDEFENSE Advisories: send email to listservat_private, subject line: "subscribe" About iDEFENSE: iDEFENSE is a global security intelligence company that proactively monitors sources throughout the world — from technical vulnerabilities and hacker profiling to the global spread of viruses and other malicious code. Our security intelligence services provide decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 dendlerat_private www.idefense.com -----BEGIN PGP SIGNATURE----- Version: PGP 7.1.2 Comment: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4B0ACC2A iQA/AwUBPa1yXUrdNYRLCswqEQITlwCfV3Ap77m8vUPKTYO1Yli3P2s+VTgAoOHK J4ZiqHNEVt6Hsaz2SPlvCfFV =8mlZ -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Wed Oct 16 2002 - 08:59:01 PDT