mailing list archives
[SAFER 000229.EXP.1.3] Remote buffer overflow in Netscape Enterprise Server 3.6 SP2
From: vanja () RELAYGROUP COM (Vanja Hrustic)
Date: Wed, 1 Mar 2000 00:48:10 +0700
S.A.F.E.R. Security Bulletin 000229.EXP.1.3
TITLE: Buffer Overflow in Netscape Enterprise Server
DATE: February 29, 2000
NATURE: Denial-of-Service, Remote Code Execution
PLATFORMS: Windows NT 4.0, possibly others
Netscape Enterprise Server is a web server with long history of security
problems. We have tested version 3.6 SP2 on Windows NT 4.0 Server
and found it to be vulnerable to a buffer overflow.
A buffer overflow exists in Netscape Enterprise Server version 3.6 SP2,
and possibly others, which allows remote users to execute arbitrary
code. The request which will cause httpd.exe process to crash is (for
GET /[4080 x 'A'] HTTP/1.0
The method seems not to be important at all, but the length of the
request does. You can use BLAH as a method (instead of GET), or any
other string you wish. Dr. Watson pops up with a message:
" Exception access violation (0xc0000005), Address 0x41414141 "
Remote execution of code is possible.
The problem is present in Netscape Enterprise Server 3.6 SP2, running
on Windows NT platform. We have also tested Netscape Enterprise Server
3.51I running on Solaris, and found it not to be vulnerable.
Until the official statement from Netscape is released, consider the
possibility that all versions are vulnerable.
We have tried to contact Netscape and inform them about vulnerabilities
(including this buffer overflow, and few others) in their web server,
but have received no reply (or acknowledgments) until now. This problem
has been found 3 months ago, Netscape has been contacted in January 2000
on several occasions. We would be happy if Netscape can contact us, so
that we can let them know about few more security problems that have
been found in Netscape Enterprise Server.
The Relay Group is seeking security enthusiasts with vast experience in
intrusion testing, and firewall/IDS configuration. For more information,
S.A.F.E.R. - Security Alert For Entreprise Resources
Copyright (c) 2000, The Relay Group
http://www.safermag.com ---- security () relaygroup com
- [SAFER 000229.EXP.1.3] Remote buffer overflow in Netscape Enterprise Server 3.6 SP2 Vanja Hrustic (Feb 29)