[SAFER 000229.EXP.1.3] Remote buffer overflow in Netscape Enterprise Server 3.6 SP2

[vanja () RELAYGROUP COM (Vanja Hrustic)]

__________________________________________________________

       S.A.F.E.R. Security Bulletin 000229.EXP.1.3
__________________________________________________________

TITLE: Buffer Overflow in Netscape Enterprise Server
DATE: February 29, 2000
NATURE: Denial-of-Service, Remote Code Execution
PLATFORMS: Windows NT 4.0, possibly others

DETAILS:

Netscape Enterprise Server is a web server with long history of security
problems. We have tested version 3.6 SP2 on Windows NT 4.0 Server
edition,
and found it to be vulnerable to a buffer overflow.

PROBLEM:

A buffer overflow exists in Netscape Enterprise Server version 3.6 SP2,
and  possibly others, which allows remote users to execute arbitrary
code. The request which will cause httpd.exe process to crash is (for
example):

GET /[4080 x 'A'] HTTP/1.0

The method seems not to be important at all, but the length of the
request does. You can use BLAH as a method (instead of GET), or any
other string you wish. Dr. Watson pops up with a message:

" Exception access violation (0xc0000005), Address 0x41414141 "

Remote execution of code is possible.

FIXES:

The problem is present in Netscape Enterprise Server 3.6 SP2, running
on Windows NT platform. We have also tested Netscape Enterprise Server
3.51I running on Solaris, and found it not to be vulnerable.

Until the official statement from Netscape is released, consider the
possibility that all versions are vulnerable.

We have tried to contact Netscape and inform them about vulnerabilities
(including this buffer overflow, and few others) in their web server,
but have received no reply (or acknowledgments) until now. This problem
has been found 3 months ago, Netscape has been contacted in January 2000
on several occasions. We would be happy if Netscape can contact us, so
that we can let them know about few more security problems that have
been found in Netscape Enterprise Server.

JOB OFFERS:

The Relay Group is seeking security enthusiasts  with vast experience in
intrusion testing, and firewall/IDS configuration. For more information,
please visit:

http://relaygroup.com/secjobs.html

___________________________________________________________

    S.A.F.E.R. - Security Alert For Entreprise Resources
            Copyright (c) 2000, The Relay Group
   http://www.safermag.com  ----  security () relaygroup com
___________________________________________________________