From patrik@cqure.net Mon Jul 1 02:57:46 2002 From: Patrik Karlsson To: vulnwatch@vulnwatch.org Date: Tue, 25 Jun 2002 18:49:33 -0100 (GMT+1) Subject: [VulnWatch] cqure.net.20020604.netware_dhcpsrvr [The following text is in the "ISO-8859-1" character set] [Your display is set for the "US-ASCII" character set] [Some characters may be displayed incorrectly] cqure.net Security Vulnerability Report No: cqure.net.20020604.netware_dhcpsrvr ======================================= Vulnerability Summary --------------------- Problem: The Netware DHCP server has a DOS vulnerability. Threat: An attacker could cause the Netware server to reboot, simple by issueing a "non-standard" dhcp request. Affected Software: Novell Netware FTP server. Platforms: Netware 6.0 verified SP 1. Solutions: Install patches from Novell as soon as they become available. Vulnerability Description ------------------------- The DHCP server suffers from multiple bufferoverflows which can be triggered by sending oversized "non-standard" requests to the DHCP server. Additional Information ---------------------- Novell was contacted 20020604. This vulnerability was found by Patrik Karlsson & Jonas Ländin patrik@cqure.net jonas@cqure.net This document is also available at: http://www.cqure.net/advisories/