mailing list archives
[CORE SDI ADVISORY] Netscape servers Denial of Service
From: Iván Arce <core.lists.bugtraq () CORE-SDI COM>
Date: Tue, 31 Oct 2000 20:08:28 -0300
Vulnerability Report For Netscape servers Denial of
Date Published: 2000-10-31
Advisory ID: CORE-2000103102
Bugtraq ID: 1867
CVE CAN: Non currently assigned.
Title: Netscape servers Denial of Service
Class: Denial of Service
Remotely Exploitable: Yes
Locally Exploitable: Yes
Release Mode: USER RELEASE
Communications with the vendor have been remarkably difficult
and to a large degree unproductive. Our last point of contact
was October 18, 2000. This last communication stated that
they would getting back to us shortly.
Twelve days and several emails later we have decided to
release without vendor support as it seems unlikely to be
A bug in several components of the Netscape Servers suite of
products allows and attacker to successfully conduct a denial
of service attack against the vulnerable systems.
The Netscape Certificate Management System has also several server
components that share the problem.
Netscape Certificate Management System 4.2 (Microsoft Windows NT 4.0
Netscape Directory Server 4.12 (Microsoft NT 4.0 version)
Contact the vendor for a fix. Patches for iPlanet products are
usually available from:
Additionally, advisories and information on security issues
of these particular Netscape products can be obtained from:
iPlanet Certificate Management System
Netscape Directory Server
Vendor notified on: October 2nd, 2000
Last contact with the vendor was on October 18th, 2000
when CORE SDI was informed that a patch for a problem
reported previously was available and that information
and a status report for the vulnerability described
in this advisory would be available later that day.
Since then no communication from the vendor was
received, even after two emails asking for
an update on October 23rd. and October 30th.
This vulnerability was found by Emiliano Kargieman and
Agustin Kato Azubel from Core SDI S.A.
This advisory was drafted with the help of the SecurityFocus.com
Vulnerability Help Team. For more information or assistance
drafting advisories please mail vulnhelp () securityfocus com
Technical Description - Exploit/Concept Code:
The Netscape Directory Server 4.12 provides a Web to LDAP gateway,
by means of the Directory Services Gateway (DSGW) web server.
No authentication credentials are required from the client to access DSGW.
The same service is installed and used as part of the Certificate
System (Netscape/iPlanet CMS 4.2) and in this case it listens on a tcp
port chosen during the installation process (24326/tcp in this example).
A request with an URI as follows:
will trigger an exception at 0x00403c62 and cause the server to hang
and stop servicing requests until the exception generated is dismissed.
The same problem is present in all the binaries in the
Netscape\Server4\dsgw\bin directory (auth,csearch,dnedit,doauth,
domodify,dosearch,edit,lang,newentry,search,unauth), except for the
The '%' can be replaced by any string with a non-alphanumeric character
in it, except for '_' and '-'. The string length doesn't matter in
this specific problem, as shown in the example above, a string
of just one non-alphanumeric character is enough.
The problem lies in a function that uses a buffer that is allocated
if the string after 'context=' is alphanumeric, but isn't if the string
The contents of this advisory are copyright (c) 2000 CORE SDI S.A.
and may be distributed freely provided that no fee is charged for this
distribution and proper credit is given.
$Id: Netscape-Servers-DoS-advisory.txt,v 1.4 2000/10/31 22:51:27 iarce Exp $
"Understanding. A cerebral secretion that enables one having it to know
a house from a horse by the roof on the house,
It's nature and laws have been exhaustively expounded by Locke,
who rode a house, and Kant, who lived in a horse." - Ambrose Bierce
==================[ CORE Seguridad de la Informacion S.A. ]=========
PGP Fingerprint: C7A8 ED85 8D7B 9ADC 6836 B25D 207B E78E 2AD1 F65A
email : iarce () core-sdi com
Florida 141 2do cuerpo Piso 7
C1005AAG Buenos Aires, Argentina.
Tel/Fax : +(54-11) 4331-5402
--- For a personal reply use iarce () core-sdi com
- [CORE SDI ADVISORY] Netscape servers Denial of Service Iván Arce (Nov 02)