[ advisories | exploits | discussions | news | conventions | security tools | texts & papers ]
 main menu
- feedback
- advertising
- privacy
- FightAIDS
- newsletter
- news
- read forum
- new topic
- search

- meetings list
- recent additions
- add your info
 top 100 sites
- visit top sites
- sign up now
- members

- add your url
- add domain
- search box
- link to us

- our projects
- free email
 m4d network
- security software
- secureroot
- m4d.com
Home : Advisories : Vulnerability Report For Netscape servers Denial of Service

Title: Vulnerability Report For Netscape servers Denial of Service
Released by: CORE SDI
Date: 31st October 2000
Printable version: Click here
                                                     CORE SDI


                   Vulnerability Report For Netscape servers  Denial of


Date Published: 2000-10-31

Advisory ID: CORE-2000103102

Bugtraq ID: 1867

CVE CAN: Non currently assigned.

Title: Netscape servers Denial of Service

Class: Denial of Service

Remotely Exploitable: Yes

Locally Exploitable: Yes

Release Mode: USER RELEASE

  Communications with the vendor have been remarkably difficult

  and to a large degree unproductive. Our last point of contact

  was October 18, 2000. This last communication stated that

  they would getting back to us shortly.

  Twelve days and several emails later we have decided to

  release without vendor support as it seems unlikely to be


Vulnerability Description:

  A bug in several components of the Netscape Servers suite of

  products allows and attacker to successfully conduct a denial

  of service attack against the vulnerable systems.

  The Netscape Certificate Management System has also several server

  components that share the problem.

Vulnerable Packages/Systems:

  Netscape Certificate Management System 4.2 (Microsoft Windows NT 4.0


  Netscape Directory Server 4.12 (Microsoft NT 4.0 version)

Solution/Vendor Information/Workaround:

  Contact the vendor for a fix. Patches for iPlanet products are

  usually available from:

  Additionally, advisories and information on security issues

  of these particular Netscape products can be obtained from:

  iPlanet Certificate Management System



  Netscape Directory Server



Vendor notified on: October 2nd, 2000

  Last contact with the vendor was on October 18th, 2000

  when CORE SDI was informed that a patch for a problem

  reported previously was available and that information

  and a status report for the vulnerability described

  in this advisory would be available later that day.

  Since then no communication from the vendor was

  received, even after two emails asking for

  an update on October 23rd. and October 30th.


  This vulnerability was found by Emiliano Kargieman and

  Agustin Kato Azubel from Core SDI S.A.

  This advisory was drafted with the help of the SecurityFocus.com

  Vulnerability Help Team. For more information or assistance

  drafting advisories please mail vulnhelp@securityfocus.com.

Technical Description - Exploit/Concept Code:

  The Netscape Directory Server 4.12 provides a Web to LDAP gateway,

   by means of the Directory Services Gateway (DSGW) web server.

  No authentication credentials are required from the client to access DSGW.

  The same service is installed and used as part of the Certificate


  System (Netscape/iPlanet CMS 4.2) and in this case it listens on a tcp

  port chosen during the installation process (24326/tcp in this example).

  A request with an URI as follows:


  will trigger an exception at 0x00403c62 and cause the server to hang

  and stop servicing requests until the exception generated is dismissed.

  The same problem is present in all the binaries in the

  Netscape\Server4\dsgw\bin directory (auth,csearch,dnedit,doauth,

  domodify,dosearch,edit,lang,newentry,search,unauth), except for the

  program 'tutor'.

  The '%' can be replaced by any string with a non-alphanumeric character

  in it, except for '_' and '-'. The string length doesn't matter in

  this specific problem, as shown in the example above, a string

  of just one non-alphanumeric character is enough.

  The problem lies in a function that uses a buffer that is allocated

  if the string after 'context=' is alphanumeric, but isn't if the string

  is non-alphanumeric.


  The contents of this advisory are copyright (c) 2000 CORE SDI S.A.

  and may be distributed freely provided that no fee is charged for this

  distribution and proper credit is given.

$Id: Netscape-Servers-DoS-advisory.txt,v 1.4 2000/10/31 22:51:27 iarce Exp $


"Understanding. A cerebral secretion that enables one having it to know

 a house from a horse by the roof on the house,

 It's nature and laws have been exhaustively expounded by Locke,

 who rode a house, and Kant, who lived in a horse." - Ambrose Bierce

==================[ CORE Seguridad de la Informacion S.A. ]=========

Iván Arce


PGP Fingerprint: C7A8 ED85 8D7B 9ADC 6836  B25D 207B E78E 2AD1 F65A

email   : iarce@core-sdi.com


Florida 141 2do cuerpo Piso 7

C1005AAG Buenos Aires, Argentina.

Tel/Fax : +(54-11) 4331-5402


--- For a personal reply use iarce@core-sdi.com

(C) 1999-2000 All rights reserved.