Vulnerability Report For Netscape Servers Heap Buffer Overflow
Bugtraq ID: 1865
CVE Name: Non currently assigned.
Title: Netscape Servers Heap Buffer Overflow
Class: Boundary Condition Error (Buffer Overflow)
Remotely Exploitable: Yes
Locally Exploitable: Yes
Release Mode: USER RELEASE
Communications with the vendor have been remarkably difficult and to a large degree unproductive. Our last point of contact was October 18, 2000. This last communication stated that they would getting back to us shortly. Twelve days and several emails later we have decided to release without vendor support as it seems unlikely to be forthcoming.
Vulnerability Description:
An exploitable heap buffer overflow vulnerability was discovered in the Netscape Directory Server product.
The Netscape Certificate Management System also has several server components that share the problem.
Vulnerable systems allow the execution of arbitrary code as the user running the services.
Vulnerable Packages/Systems:
Netscape Certificate Management System 4.2 (Microsoft Windows NT 4.0 version)
Netscape Directory Server 4.12 (Microsoft NT 4.0 version)
Solution/Vendor Information/Workaround:
Contact the vendor for a fix. Patches for iPlanet products are usually available from:
http://www.iplanet.com/downloads/patches/index.html
Additionally, advisories and information on security issues of these particular Netscape products can be obtained from:
iPlanet Certificate Management System
http://www.securityfocus.com/bid/1839
http://www.securityfocus.com/bid/676
Netscape Directory Server
http://www.securityfocus.com/bid/1839
http://www.securityfocus.com/bid/676
Vendor notified on: October 2nd. 2000
Last contact with the vendor was on October 18th, 2000 when CORE SDI was informed that a patch for a problem reported previously was available and that information and a status report for the vulnerability described in this advisory would be available later that day.
Since then no communication from the vendor was received, even after two emails asking for an update on October 23rd. and October 30th.
Credits:
This vulnerability was found by Emiliano Kargieman and Agustin Kato Azubel from Core SDI S.A.
This advisory was drafted with the help of the SecurityFocus.com Vulnerability Help Team. For more information or assistance drafting advisories please mail [email protected].
Technical Description - Exploit/Concept Code:
The Netscape Directory Server 4.12 provides a Web to LDAP gateway, by means of the Directory Services Gateway (DSGW) web server.
No authentication credentials are required from the client to access DSGW.
The same service is installed and used as part of the Certificate Management System (Netscape/iPlanet CMS 4.2) and in this case it listens on a tcp port chosen during the installation process (24326/tcp in this example)
A request with an URI as follows: