search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Novell NetWare Enterprise Web Server /perl/ handler vulnerable to buffer overflow

Vulnerability Note VU#185593

Original Release Date: 2003-07-23 | Last Revised: 2003-08-08

Overview

Novell NetWare Enterprise Web Server contains a buffer overflow vulnerability that can be exploited via the /perl/ HTTP request handler. A remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the server process.

Description

Novell NetWare 5.1 and 6.0 include a web server called NetWare Enterprise Server. The server contains a buffer overflow vulnerability that can be triggered by a specially crafted HTTP request directed to the /perl/ handler. The vulnerability occurs in the module CGI2PERL.NLM, which is mapped to the /perl/ directory in an HTTP request. Further information is available in Novell Technical Information Document 2966549 and PROTEGO Security Advisory #PSA200301.

NetWare 5.1 with NetWare Enterprise Web Server 3.6 and certain NetWare 6.0 systems (NetWare Enterprise Web Server 6.00d) are affected. In particular, NetWare 6.0 systems that have been upgraded from 5.1 may be affected.

Impact

A remote attacker could cause the web server to hang or restart (ABEND), resulting in a denial of service. Since EIP is overwritten, it may be possible for the attacker to execute arbitrary code with the privileges of the server process (Admin).

Solution

Apply a patch
Apply the appropriate patch referenced in Novell TID 2966549.


Unmap /perl/ handler

If it is not needed, unmap the /perl/ request handler. Information about how to configure the /perl/ CGI directory can be found in Novell's Perl documentation for Netware Enterprise Web Server.

Vendor Information

185593
 

Novell Affected

Notified:  May 08, 2003 Updated: July 23, 2003

Status

Affected

Vendor Statement

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

For Immediate Disclosure

============================== Summary ==============================

Security Alert: NOVL-2003-2966549
Title: Enterprise Web Server PERL Handler Buffer Overflow
Date: 23-Jul-2003
Revision: Original
Product Name: Netware Enterprise Web Server
OS/Platform(s): Netware 5.1, 6.0
Reference URL: http://support.novell.com/servlet/tidfinder/2966549
Vendor Name: Novell, Inc.
Vendor URL: http://www.novell.com
Security Alerts: http://support.novell.com/security-alerts
Affects: cgi2perl.nlm
Identifiers: CERT VU# 185593, CVE: CAN-2003-0562
Credits: Uffe Nielsen

============================ Description ============================

A Buffer Overflow in the PERL handler, (/perl/) may result in a
server ABEND.  The problem is not in the Netscape-based Enterprise
Web Server, but in the Novell-supplied cgi2perl.nlm handler to PERL.

============================== Impact ===============================

One or more server ABENDs may be triggered by buffer overflows,
resulting in degraded performance or crash of the server, in turn
causing in a denial of service to legitimate users of the system.
There is no known ROOT shell exploit from this kind of failure on
Netware.

======================== Recommended Actions ========================

See detailed instructions in the referenced Technical Information
Document (TID) http://support.novell.com/servlet/tidfinder/2966549.

============================ DISCLAIMER =============================

The content of this document is believed to be accurate at the time
of publishing based on currently available information. However, the
information is provided "AS IS" without any warranty or
representation. Your use of the document constitutes acceptance of
this disclaimer. Novell disclaims all warranties, express or implied,
regarding this document, including the warranties of merchantability
and fitness for a particular purpose. Novell is not liable for any
direct, indirect, or consequential loss or damage arising from use
of, or reliance on, this document or any security alert, even if
Novell has been advised of the possibility of such damages and even
if such damages are foreseeable.

============================ Appendices =============================

None

================ Contacting Novell Security Alerts ==================

To report suspected security vulnerabilities in Novell products, send
email to
secure@novell.com

or use the web form at our website

http://support.novell.com/security-alerts

PGP users may send signed/encrypted information to us using our PGP
key, available from the pgpkeys.mit.edu server, or our website.

Users wishing to be notified when Novell Security Alerts are issued
may register their email address at

http://www.novell.com/info/list/

Security Alerts, Novell, Inc. PGP Key Fingerprint:

F5AE 9265 0A34 F84E 580E  9B87 3AC1 1974 DE05 0FDB

========================= Revision History ==========================
Original: 23-Jul-2003 - Original Publication

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Security 7.0.3

iQA/AwUBPx5ssDrBGXTeBQ/bEQIVNwCg1XYO7F/Ddsl3V3QXo8WlYaogVDcAn1v0
bRRR7anxwjvMOWpId5aC0Vwl
=2sd0
-----END PGP SIGNATURE-----

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see Novell Technical Information Document 2966549.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

This vulnerability was reported by Uffe Nielsen of PROTEGO.

This document was written by Art Manion.

Other Information

CVE IDs: CVE-2003-0562
Severity Metric: 7.22
Date Public: 2003-07-23
Date First Published: 2003-07-23
Date Last Updated: 2003-08-08 21:58 UTC
Document Revision: 37

Sponsored by CISA.