From patrik.karlsson@se.pwcglobal.com Thu May 9 02:49:44 2002 From: Patrik Karlsson To: bugtraq@securityfocus.com Date: Wed, 8 May 2002 12:03:11 +0200 Subject: cqure.net.20020412.bordermanager_36_mv1.a [The following text is in the "iso-8859-1" character set] [Your display is set for the "US-ASCII" character set] [Some characters may be displayed incorrectly] cqure.net Security Vulnerability Report No: cqure.net.20020412.bordermanager_36_mv1.a ============================================== Vulnerability Summary --------------------- Problem: Multiple vulnerabilities identified in Novell Border Manager 3.6. During our brief look at Novell Border Manager 3.6, we have identified three issues within the product. The vulnerabilities will cause the handling NLM to abend, and in some cases result in a DOS of the Novell server. Threat: An attacker could prevent legitimate use of the Novell server, by sending special crafted information to the server. Affected Software: Border Manager 3.6 SP 1a. Platform: Netware 6.0 SP 1 verified. Vulnerability Description ------------------------- The first vulnerability is within the FTP-proxy server of BM 3.6. After issuing the connection request to the proxy an attacker could send a couple of megs of random data, which would cause the server to stop responding to tcp/ip for a while. The server will then start answering tcp/ip traffic again after 10 to 20 seconds. If this is repeated for ten times or so, our test environment stop responding to tcp/ip alltogether, and the server had to be rebooted to regain full functionability. The second vulnerability is in the ip/ipx gateway on tcp port 8225. If one would send approximately two megabytes of random data to this port, the nlm ipipxgw.nlm will abend. The third vulnerability is in the RTSP proxy running on port 9090. One could cause the proxy.nlm to abend by simply connecting to the port, issuing the command "GET" followed by six enters. Solution -------- Filter incoming connections to the ports 21, 8225 and 9090. As soon as patches become available, apply them. Additional Information ---------------------- Novell was contacted 20020412 and have been unable to reproduce the issues up until today. This vulnerability was found and researched by Patrik Karlsson & Jonas Ländin patrik.karlsson@se.pwcglobal.com jonas.landin@ixsecurity.com This document is also available at: http://www.cqure.net/advisories/