defcom.netscape-enterprise.txt

`======================================================================  
Defcom Labs Advisory def-2001-04  
  
Netscape Enterprise Server Dot-DoS  
  
Author: Peter Gründl <[email protected]>  
Release Date: 2001-01-22  
======================================================================  
------------------------=[Brief Description]=-------------------------  
The Netscape Enterprise Server 4.1, SP5 has a problem dealing with  
dotdot-URLs. The problem can result in the service crashing.  
  
------------------------=[Affected Systems]=--------------------------  
- Netscape Enterprise Server 4.1, SP5 for Windows NT 4.0  
  
----------------------=[Detailed Description]=------------------------  
If a GET request is performed which includes at least 1344 x /../, the  
web service will crash. This goes for both the normal HTTP service and  
the admin service. The crash has to be performed twice, since NES will  
reestablish the service the first time it crashes.  
  
---------------------------=[Workaround]=-----------------------------  
None known. We've only come across this bug on 4.1, SP5, but would not  
rule out the possibility of it existing in other versions.  
  
-------------------------=[Vendor Response]=--------------------------  
This issue was brought to the vendor's attention on the 7th of  
December, 2000. Vendor replied on the 22nd of January, 2001 and has  
been unable to reproduce the bug:  
  
"I've used their perl script to abuse an iWS4.1sp5 server. The server  
does not crash, politetly returns errors to the client, and logs  
errors.  
  
However, given the announcement on the Iplanet Web site regarding iWS  
stability I would recommend they upgrade to SP6, URL given below.  
  
http://www.iplanet.com/support/iws-alert/index.html"  
  
According to the URL supplied by Netscape, there is no SP6 for IWS4.1,  
so it is adviced that people try this out for themselves to determine  
if they are vulnerable. It was found on Windows NT 4.0, with SP6a.  
  
======================================================================  
This release was brought to you by Defcom Labs  
  
[email protected] www.defcom.com  
======================================================================  
  
  
  
`