AusCERT - ESB-2006.0945 -- [Netware] -- Multiple vulnerabilities in Novell NetMail

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2006.0945 -- [Netware] -- Multiple vulnerabilities in Novell NetMail
Date: 27 December 2006

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                        ESB-2006.0945 -- [Netware]
                Multiple vulnerabilities in Novell NetMail
                             27 December 2006

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Novell NetMail 3.52
Publisher:            iDEFENSE
                      TippingPoint
Operating System:     Netware
Impact:               Execute Arbitrary Code/Commands
                      Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-6424 CVE-2006-6425

Original Bulletin:
  http://www.zerodayinitiative.com/advisories/ZDI-06-052.html
  http://www.zerodayinitiative.com/advisories/ZDI-06-053.html
  http://www.zerodayinitiative.com/advisories/ZDI-06-054.html
  http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=454
  http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=455

Comment: This bulletin combines 5 advisories, each of which describes a
         vulnerabilitiy in Novell Netmail. For patch availability and
         Novell's response, please see:
         
  https://secure-support.novell.com/KanisaPlatform/Publishing/134/3096026_f.SAL_Public.html
  https://secure-support.novell.com/KanisaPlatform/Publishing/328/3717068_f.SAL_Public.html

- --------------------------BEGIN INCLUDED TEXT--------------------

ZDI-06-052: Novell NetMail NMAP STOR Buffer Overflow Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-06-052.html
December 22, 2006

- -- CVE ID:
CVE-2006-6424

- -- Affected Vendor:
Novell

- -- Affected Products:
Novell NetMail 3.5.2

- -- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability since September 14, 2006 by Digital Vaccine protection
filter ID 3902. For further product information on the TippingPoint IPS:

    http://www.tippingpoint.com 

- -- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
affected installations of Novell NetMail. Successful exploitation
requires the attacker to successfully authenticate to the affected
service.

The specific flaw exists in NetMail's implementation of the Network
Messaging Application Protocol (NMAP). The NMAP server lacks bounds
checking on parameters supplied to the STOR command, which can lead to
an exploitable buffer overflow. The vulnerable daemon, nmapd.exe, binds
to TCP port 689.

- -- Vendor Response:
Novell has issued an update to correct this vulnerability. More details
can be found at:

 
http://www.novell.com/support/search.do?cmd=displayKC&externalId=3096026&sliceId=SAL_Public

- -- Disclosure Timeline:
2006.09.08 - Vulnerability reported to vendor
2006.09.14 - Digital Vaccine released to TippingPoint customers
2006.12.22 - Coordinated public release of advisory

- -- Credit:
This vulnerability was discovered by Dennis Rand - CIRT.DK.

- -- About the Zero Day Initiative (ZDI):
Established by TippingPoint, a division of 3Com, The Zero Day Initiative
(ZDI) represents a best-of-breed model for rewarding security
researchers for responsibly disclosing discovered vulnerabilities.

Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:

    http://www.zerodayinitiative.com

The ZDI is unique in how the acquired vulnerability information is used.
3Com does not re-sell the vulnerability details or any exploit code.
Instead, upon notifying the affected product vendor, 3Com provides its
customers with zero day protection through its intrusion prevention
technology. Explicit details regarding the specifics of the
vulnerability are not exposed to any parties until an official vendor
patch is publicly available. Furthermore, with the altruistic aim of
helping to secure a broader user base, 3Com provides this vulnerability
information confidentially to security vendors (including competitors)
who have a vulnerability protection or mitigation product.



ZDI-06-053: Novell NetMail IMAP Verb Literal Heap Overflow Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-06-053.html
December 22, 2006

- -- CVE ID:
CVE-2006-6424

- -- Affected Vendor:
Novell

- -- Affected Products:
Novell NetMail 3.5.2

- -- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability since December 21, 2006 by Digital Vaccine protection
filter ID 4543. For further product information on the TippingPoint IPS:

    http://www.tippingpoint.com 

- -- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
affected versions of Novell NetMail. Authentication is not required to
exploit this vulnerability.

The specific flaw exists in the NetMail IMAP service, imapd.exe. The
service does not sufficiently validate user-input length values when
literals are appended to IMAP verbs to specify a command continuation
request. The memory allocated to store the additional data may be
insufficient, leading to an exploitable heap-based buffer overflow.

- -- Vendor Response:
Novell has issued an update to correct this vulnerability. More details
can be found at:

 
http://www.novell.com/support/search.do?cmd=displayKC&externalId=3096026&sliceId=SAL_Public

- -- Disclosure Timeline:
2006.08.14 - Vulnerability reported to vendor
2006.12.21 - Digital Vaccine released to TippingPoint customers
2006.12.22 - Coordinated public release of advisory

- -- Credit:
This vulnerability was discovered by an anonymous researcher.

- -- About the Zero Day Initiative (ZDI):
Established by TippingPoint, a division of 3Com, The Zero Day Initiative
(ZDI) represents a best-of-breed model for rewarding security
researchers for responsibly disclosing discovered vulnerabilities.

Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:

    http://www.zerodayinitiative.com

The ZDI is unique in how the acquired vulnerability information is used.
3Com does not re-sell the vulnerability details or any exploit code.
Instead, upon notifying the affected product vendor, 3Com provides its
customers with zero day protection through its intrusion prevention
technology. Explicit details regarding the specifics of the
vulnerability are not exposed to any parties until an official vendor
patch is publicly available. Furthermore, with the altruistic aim of
helping to secure a broader user base, 3Com provides this vulnerability
information confidentially to security vendors (including competitors)
who have a vulnerability protection or mitigation product.



ZDI-06-054: Novell NetMail IMAP APPEND Buffer Overflow Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-06-054.html
December 22, 2006

- -- CVE ID:
CVE-2006-6425

- -- Affected Vendor:
Novell

- -- Affected Products:
Novell NetMail 3.5.2

- -- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability since December 21, 2006 by Digital Vaccine protection
filter ID 3868. For further product information on the TippingPoint IPS:

    http://www.tippingpoint.com 

- -- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
affected installations of Novell NetMail. Successful exploitation
requires the attacker to successfully authenticate to the affected
service.

The specific flaw exists in the NetMail IMAP server's handling of the
APPEND command. A lack of bounds checking on a specific parameter to
this command can lead to a stack-based buffer overflow. This
vulnerability can be exploited to execute arbitrary code.

- -- Vendor Response:
Novell has issued an update to correct this vulnerability. More details
can be found at:

 
http://www.novell.com/support/search.do?cmd=displayKC&externalId=3096026&sliceId=SAL_Public

- -- Disclosure Timeline:
2006.08.14 - Vulnerability reported to vendor
2006.12.21 - Digital Vaccine released to TippingPoint customers
2006.12.22 - Coordinated public release of advisory

- -- Credit:
This vulnerability was discovered by an anonymous researcher.

- -- About the Zero Day Initiative (ZDI):
Established by TippingPoint, a division of 3Com, The Zero Day Initiative
(ZDI) represents a best-of-breed model for rewarding security
researchers for responsibly disclosing discovered vulnerabilities.

Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:

    http://www.zerodayinitiative.com

The ZDI is unique in how the acquired vulnerability information is used.
3Com does not re-sell the vulnerability details or any exploit code.
Instead, upon notifying the affected product vendor, 3Com provides its
customers with zero day protection through its intrusion prevention
technology. Explicit details regarding the specifics of the
vulnerability are not exposed to any parties until an official vendor
patch is publicly available. Furthermore, with the altruistic aim of
helping to secure a broader user base, 3Com provides this vulnerability
information confidentially to security vendors (including competitors)
who have a vulnerability protection or mitigation product.



Novell NetMail IMAPD subscribe Buffer Overflow Vulnerability

iDefense Security Advisory 12.23.06
http://labs.idefense.com/intelligence/vulnerabilities/
Dec 23, 2006

I. BACKGROUND

Novell NetMail is an e-mail and calendar system that is based on standard
Internet protocols.

More information can be found at the vendors site:

http://www.novell.com/products/netmail/

II. DESCRIPTION

Remote exploitation of a buffer overflow vulnerability in Novell Inc.'s
NetMail IMAP daemon allows authenticated attackers to execute arbitrary
code with the privileges of the underlying user.

Once logged in, attackers can execute the "subscribe" command with an
overly long argument string to overflow a stack based buffer.

III. ANALYSIS

Exploitation allows authenticated remote attackers to execute arbitrary
code with the privileges of the underlying user.

IV. DETECTION

iDefense has confirmed the existence of the vulnerability in version 3.52d
of Novell NetMail.  It is suspected that earlier versions of NetMail are
also affected.

V. WORKAROUND

iDefense is currently unaware of any effective workaround for this issue.

VI. VENDOR RESPONSE

Novell has addressed this vulnerability in version 3.52e FTF2 of NetMail.
For more information consult Novell TID 3717068.  This document is
available at the following link.

http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=3717068&sliceId=SAL_Public&dialogID=22219381&stateId=0%200%2022225106

VII. CVE INFORMATION

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.

VIII. DISCLOSURE TIMELINE

10/10/2006  Initial vendor notification
10/11/2006  Initial vendor response
12/23/2006  Coordinated public disclosure

IX. CREDIT

This vulnerability was reported to iDefense by CIRT.DK.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright © 2006 iDefense, Inc.

Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of
iDefense. If you wish to reprint the whole or any part of this alert in
any other medium other than electronically, please e-mail
customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate at
the time of publishing based on currently available information. Use of
the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on, this
information.



Novell Netmail IMAP append Denial of Service Vulnerability

iDefense Security Advisory 12.23.06
http://labs.idefense.com/intelligence/vulnerabilities/
Dec 23, 2006

I. BACKGROUND

Novell NetMail is an e-mail and calendar system that is based on standard
Internet protocols.

More information can be found at the vendors site:

http://www.novell.com/products/netmail/

II. DESCRIPTION

Remote exploitation of a Denial of Service vulnerability in Novell Netmail
3.52 could allow an authenticated attacker the ability to crash the imapd
server.

Novell NetMail can be made to crash by sending an APPEND command with a
single '(' character as an argument.

III. ANALYSIS

This vulnerability is limited to a DoS only condition and requires
authentication in order to exploit it.

IV. DETECTION

iDefense has confirmed the existence of this vulnerability in the IMAPD
server of Novell NetMail 3.52d and 3.52e. Older versions are suspected to
be vulnerable as well.

V. WORKAROUND

iDefense is currently unaware of any effective workaround for this issue.

VI. VENDOR RESPONSE

Novell has addressed this vulnerability in version 3.52e FTF2 of NetMail.
For more information consult Novell TID 3717068.  This document is
available at the following link.

http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=3717068&sliceId=SAL_Public&dialogID=22219381&stateId=0%200%2022225106

VII. CVE INFORMATION

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.

VIII. DISCLOSURE TIMELINE

10/16/2006  Initial vendor notification
10/19/2006  Initial vendor response
12/23/2006  Coordinated public disclosure

IX. CREDIT

This vulnerability was reported to iDefense by CIRT.DK.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright © 2006 iDefense, Inc.

Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of
iDefense. If you wish to reprint the whole or any part of this alert in
any other medium other than electronically, please e-mail
customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate at
the time of publishing based on currently available information. Use of
the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on, this
information.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRZHN3Ch9+71yA2DNAQII2AP/Xf/D0GLUBscVmGfvoIqq3iQ67kTDj//D
T0NdHI18oxFlwBQH5tnXCPgaw2kcxc8UhYDwO1GMtaylUuunIypDcpe46CSx4LXy
UPCbuLDC8TolVY5B36BxoURv2uiAqzFYdyxhp6mfEPJ/68XNkn9t+4L1G4ofR6mi
DsM2r70py00=
=Er74
-----END PGP SIGNATURE-----