[CORE SDI ADVISORY] Netscape servers heap buffer overflow

[Iván Arce <core.lists.bugtraq () CORE-SDI COM>]

                                                   CORE SDI
                                       http://www.core-sdi.com

               Vulnerability Report For Netscape Servers Heap Buffer
Overflow

Date Published: 2000-10-31

Advisory ID: CORE-2000103101

Bugtraq ID: 1865

CVE CAN: Non currently assigned.

Title: Netscape Servers Heap Buffer Overflow

Class: Boundary Condition Error (Buffer Overflow)

Remotely Exploitable: Yes

Locally Exploitable: Yes

Release Mode: USER RELEASE

  Communications with the vendor have been remarkably difficult
  and to a large degree unproductive. Our last point of contact
  was October 18, 2000. This last communication stated that
  they would getting back to us shortly.
  Twelve days and several emails later we have decided to
  release without vendor support as it seems unlikely to be
  forthcoming.

Vulnerability Description:

   An exploitable heap buffer overflow vulnerability was discovered in
  the Netscape Directory Server product.
  The Netscape Certificate Management System also has several server
  components that share the problem.
  Vulnerable systems allow the execution of arbitrary code as the user
running
  the services.

Vulnerable Packages/Systems:

  Netscape Certificate Management System 4.2 (Microsoft Windows NT 4.0
version)
  Netscape Directory Server 4.12 (Microsoft NT 4.0 version)

Solution/Vendor Information/Workaround:

  Contact the vendor for a fix. Patches for iPlanet
  products are usually available from:

    http://www.iplanet.com/downloads/patches/index.html

  Additionally, advisories and information on security issues
  of these particular Netscape products can be obtained from:

  iPlanet Certificate Management System
     http://www.securityfocus.com/bid/1839
     http://www.securityfocus.com/bid/676

  Netscape Directory Server
    http://www.securityfocus.com/bid/1839
    http://www.securityfocus.com/bid/676

Vendor notified on: October 2nd. 2000

  Last contact with the vendor was on October 18th, 2000
  when CORE SDI was informed that a patch for a problem
  reported previously was available and that information
  and a status report for the vulnerability described
  in this advisory would be available later that day.
  Since then no communication from the vendor was
  received, even after two emails asking for
  an update on October 23rd. and October 30th.

 Credits:

  This vulnerability was found by Emiliano Kargieman and
  Agustin Kato Azubel from Core SDI S.A.

  This advisory was drafted with the help of the SecurityFocus.com
  Vulnerability Help Team. For more information or assistance
  drafting advisories please mail vulnhelp () securityfocus com.

Technical Description - Exploit/Concept Code:
  The Netscape Directory Server 4.12 provides a Web to LDAP gateway,
  by means of the Directory Services Gateway (DSGW) web server.
  No authentication credentials are required from the client to access DSGW.
  The same service is installed and used as part of the Certificate
Management
   System (Netscape/iPlanet CMS 4.2) and in this case it listens on a tcp
  port chosen during the installation process (24326/tcp in this example)

  A request with an URI as follows:
    http://server:24326/dsgw/bin/search?context=<1011 'a' chars>
  will overflow a buffer located in the heap.

  This buffer is allocated at 404501 with a call to an internal
  function that ends up calling MSVCRT!malloc. The buffer is allocated
  with a fixed size of 1024 bytes.
  Then at 40455B a call to sprintf is made like this:
    sprintf(pFixedBuffer, "%s$$LANGDIR/%s.conf", "../context/", userbuff);
  since sprintf doesn't do any bounds checking, the buffer can be
  overflowed depending on the size of 'userbuff' which is the
  argument the user specifies to the 'context=' parameter when
  calling the vulnerable program. A string of 999 bytes is
  enough to overflow the 'pFixedBuffer' by 1 byte and cause
  an exception.

  Due to the nature of the data overwritten, this vulnerability
  could be exploited, being possible to execute arbitrary machine code.

  The same problem seems to be present in almost all the binaries (12)
  in the Netscape\Server4\dsgw\bin directory (except for tutor).

DISCLAIMER:
  The contents of this advisory are copyright (c) 2000 CORE SDI S.A.
  and may be distributed freely provided that no fee is charged for this
  distribution and proper credit is given.

$Id: Netscape-Servers-advisory.txt,v 1.3 2000/10/31 22:47:47 iarce Exp $
---

"Understanding. A cerebral secretion that enables one having it to know
 a house from a horse by the roof on the house,
 It's nature and laws have been exhaustively expounded by Locke,
 who rode a house, and Kant, who lived in a horse." - Ambrose Bierce


==================[ CORE Seguridad de la Informacion S.A. ]=========
Iván Arce
Presidente
PGP Fingerprint: C7A8 ED85 8D7B 9ADC 6836  B25D 207B E78E 2AD1 F65A
email   : iarce () core-sdi com
http://www.core-sdi.com
Florida 141 2do cuerpo Piso 7
C1005AAG Buenos Aires, Argentina.
Tel/Fax : +(54-11) 4331-5402
=====================================================================


--- For a personal reply use iarce () core-sdi com