Notified:  May 08, 2003 Updated: July 23, 2003

Status

Affected

Vendor Statement

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For Immediate Disclosure ============================== Summary ============================== Security Alert: NOVL-2003-2966549 Title: Enterprise Web Server PERL Handler Buffer Overflow Date: 23-Jul-2003 Revision: Original Product Name: Netware Enterprise Web Server OS/Platform(s): Netware 5.1, 6.0 Reference URL: http://support.novell.com/servlet/tidfinder/2966549 Vendor Name: Novell, Inc. Vendor URL: http://www.novell.com Security Alerts: http://support.novell.com/security-alerts Affects: cgi2perl.nlm Identifiers: CERT VU# 185593, CVE: CAN-2003-0562 Credits: Uffe Nielsen ============================ Description ============================ A Buffer Overflow in the PERL handler, (/perl/) may result in a server ABEND. The problem is not in the Netscape-based Enterprise Web Server, but in the Novell-supplied cgi2perl.nlm handler to PERL. ============================== Impact =============================== One or more server ABENDs may be triggered by buffer overflows, resulting in degraded performance or crash of the server, in turn causing in a denial of service to legitimate users of the system. There is no known ROOT shell exploit from this kind of failure on Netware. ======================== Recommended Actions ======================== See detailed instructions in the referenced Technical Information Document (TID) http://support.novell.com/servlet/tidfinder/2966549. ============================ DISCLAIMER ============================= The content of this document is believed to be accurate at the time of publishing based on currently available information. However, the information is provided "AS IS" without any warranty or representation. Your use of the document constitutes acceptance of this disclaimer. Novell disclaims all warranties, express or implied, regarding this document, including the warranties of merchantability and fitness for a particular purpose. Novell is not liable for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this document or any security alert, even if Novell has been advised of the possibility of such damages and even if such damages are foreseeable. ============================ Appendices ============================= None ================ Contacting Novell Security Alerts ================== To report suspected security vulnerabilities in Novell products, send email to secure@novell.com or use the web form at our website http://support.novell.com/security-alerts PGP users may send signed/encrypted information to us using our PGP key, available from the pgpkeys.mit.edu server, or our website. Users wishing to be notified when Novell Security Alerts are issued may register their email address at http://www.novell.com/info/list/ Security Alerts, Novell, Inc. PGP Key Fingerprint: F5AE 9265 0A34 F84E 580E 9B87 3AC1 1974 DE05 0FDB ========================= Revision History ========================== Original: 23-Jul-2003 - Original Publication -----BEGIN PGP SIGNATURE----- Version: PGP Personal Security 7.0.3 iQA/AwUBPx5ssDrBGXTeBQ/bEQIVNwCg1XYO7F/Ddsl3V3QXo8WlYaogVDcAn1v0 bRRR7anxwjvMOWpId5aC0Vwl =2sd0 -----END PGP SIGNATURE-----

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see Novell Technical Information Document 2966549.