Sign-up

ID

VAR-201002-0327


TITLE

Novell NetStorage xsrvd Long Pathname Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-10-021

DESCRIPTION

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell NetStorage. Authentication is not required to exploit this vulnerability.The specific flaws exists within the xsrvd process during the wide character conversion of requested file paths. In conjunction with a long username value the file path conversion will result in a heap overflow corrupting a chunk that will be immediately freed. This can be leveraged by remote attackers to compromise the NetStorage server. Novell NetStorage is prone to a heap-based buffer-overflow vulnerability. This issue affects NetStorage and the following: - NetWare 6.5 Support Pack 8 - Open Enterprise Server 2 (OES 2) Linux Support Pack 1 - Open Enterprise Server 2 (OES 2) Linux Support Pack 2. ZDI-10-021: Novell NetStorage xsrvd Long Pathname Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-021 February 23, 2010 -- Affected Vendors: Novell -- Affected Products: Novell NetStorage -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 9290. Authentication is not required to exploit this vulnerability. -- Vendor Response: Novell has issued an update to correct this vulnerability. More details can be found at: http://www.novell.com/support/viewContent.do?externalId=7005282 -- Disclosure Timeline: 2009-10-21 - Vulnerability reported to vendor 2010-02-23 - Coordinated public release of advisory -- Credit: This vulnerability was discovered by: * 1c239c43f521145fa8385d64a9c32243 -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Trust: 0.99

sources: ZDI: ZDI-10-021 // BID: 38087 // PACKETSTORM: 86611

AFFECTED PRODUCTS

vendor:novellmodel:netstoragescope: - version: -

Trust: 0.7

vendor:novellmodel:open enterprise server (oes linux support pacscope:eqversion:11)11

Trust: 0.3

vendor:novellmodel:open enterprise server (oes linuxscope:eqversion:11)11

Trust: 0.3

vendor:novellmodel:netware sp8scope:eqversion:6.5.0

Trust: 0.3

vendor:novellmodel:netstoragescope:eqversion:3.1.5-19

Trust: 0.3

sources: ZDI: ZDI-10-021 // BID: 38087

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI: ZDI-10-021
value: HIGH

Trust: 0.7

ZDI: ZDI-10-021
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

sources: ZDI: ZDI-10-021

THREAT TYPE

network

Trust: 0.3

sources: BID: 38087

TYPE

Boundary Condition Error

Trust: 0.3

sources: BID: 38087

PATCH

title:Novell has issued an update to correct this vulnerability.url:http://www.novell.com/support/viewcontent.do?externalid=7005282

Trust: 0.7

sources: ZDI: ZDI-10-021

EXTERNAL IDS

db:ZDIid:ZDI-10-021

Trust: 1.1

db:ZDI_CANid:ZDI-CAN-607

Trust: 0.7

db:BIDid:38087

Trust: 0.3

db:PACKETSTORMid:86611

Trust: 0.1

sources: ZDI: ZDI-10-021 // BID: 38087 // PACKETSTORM: 86611

REFERENCES

url:http://www.novell.com/support/viewcontent.do?externalid=7005282

Trust: 1.1

url:http://www.zerodayinitiative.com/advisories/zdi-10-021

Trust: 0.4

url:http://www.novell.com/products/openenterpriseserver/netstorage.html

Trust: 0.3

url:http://www.zerodayinitiative.com/advisories/disclosure_policy/

Trust: 0.1

url:http://secunia.com/

Trust: 0.1

url:http://www.tippingpoint.com

Trust: 0.1

url:http://www.zerodayinitiative.com

Trust: 0.1

url:http://lists.grok.org.uk/full-disclosure-charter.html

Trust: 0.1

sources: ZDI: ZDI-10-021 // BID: 38087 // PACKETSTORM: 86611

CREDITS

1c239c43f521145fa8385d64a9c32243

Trust: 0.7

sources: ZDI: ZDI-10-021

SOURCES

db:ZDIid:ZDI-10-021
db:BIDid:38087
db:PACKETSTORMid:86611

LAST UPDATE DATE

2022-05-17T01:41:44.759000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-10-021date:2010-02-23T00:00:00
db:BIDid:38087date:2010-02-23T23:11:00

SOURCES RELEASE DATE

db:ZDIid:ZDI-10-021date:2010-02-23T00:00:00
db:BIDid:38087date:2010-02-03T00:00:00
db:PACKETSTORMid:86611date:2010-02-24T01:05:29