Date: Wed, 2 Jul 2008 18:13:01 -0300
From: "[ISR] - Infobyte Security Research" <noreply@...obyte.com.ar>
To: full-disclosure@...ts.grok.org.uk
Subject: Novell GroupWise Messenger Client (GWIM) Remote
	Stack Overflow

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

|| 
|| [ISR]          
|| Infobyte Security Research 
|| www.infobyte.com.ar
|| 07.02.2008
||


.:: SUMMARY

Novell GroupWise Messenger Client (GWIM) Remote Stack Overflow


Version: 2.0, It is suspected that all previous versions of Groupwise
Messenger Client are vulnerable.

.:: BACKGROUND

Novell GroupWise Messenger is a corporate instant messaging product that uses
Novell eDirectory? as its user database


More info:    http://www.novell.com

.:: VULNERABILITY VIDEO DEMO

http://www.infobyte.com.ar/demo/ISR_groupwise_messenger.html


.:: POC

ISR-groupwisemsn.pl, simple fake groupwise msn server.
http://www.infobyte.com.ar/developments.html

.:: DESCRIPTION

Issue 1:
- -------

This issue is due to a failure of the application to securely parse the
server's response.
The application server works similarly to HTTP protocol, default tcp port
8300.
The server always response the client's request with something like this:


"
HTTP/1.0 200 \r
Date: xxx, xx xxx xxxx xx:xx:xx GMT\r
Pragma: no-cache\r
Cache-Control: no-cache\r
\r

%VALUES%
\0\0\0
\0\24\0\0\0NM_A_SZ_RESULT_CODE\0\2\0\0\x000\0
\0\27\0\0\0NM_A_SZ_TRANSACTION_ID\0\2\0\0\x001\0\0

"

If the client application receive a server response to any request like the
following, a stack overflow is occurred:
"
HTTP/1.0 200 \r
Date: xxx, xx xxx xxxx xx:xx:xx GMT\r
Pragma: no-cache\r

Cache-Control: no-cache\r
\r

%VALUES%
\0\0\0
\0\24\0\0\0NM_A_SZ_RESULT_CODE\0\2\0\0\x000\0
\0\27\0\0\0NM_A_SZ_TRANSACTION_ID\0\2\0\0\x001\0\0"+ "AAAAAAAAAA...." x 5000

Issue 2:
- ------

We found another stack overflow regarding the client's popup alerts,
when you receive a message of another user the server send a string like
this to the client:

"l\0\0\x001\0\0\0CN=XXXX,OU=XX,OU=XXXX,OU=XX,OU=XX,O=INFOBYTEXX\0'\0\0\0[87

1F8247-4B110000-0A01C80A-6C20-010
0]\0\1\0\0\0\xE4\0\0\0{\\rtf1\\fbidis\\ansi\\ansicpg1252\\deff0\\deflang308
2{\\fonttbl{\\f0\\fswiss\\fprq2\\fcharset0
fontname;}}\r\n{\\colortbl;\\red0\\green0\\blue0;}\r\n\\viewkind4\\uc1\\par

d\\ltrpar\\li50\\ri50\\cf1\\f0\\fs20 MESSAGE\\par\r\n}\r\n\0";

If a client receive a string like this but in any place of the string it's
added an "A" x 5000 you have another stack overflow.



.:: IMPACT

Both vulnerabilities permit arbitrary code execution.

.:: VENDOR RESPONSE

Vendor advisory:
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5026700.html

.:: CVE INFORMATION

Id: CVE-2008-2703, CVE-2008-2704
Web: http://cve.mitre.org
    
.:: DISCLOSURE TIMELINE

01/12/2008  Initial vendor notification
01/13/2007  Initial vendor response notify research
06/10/2007  Coordinated public disclosure
 
.:: CREDIT

Francisco Amato is credited with discovering this vulnerability.

famato][at][infobyte][dot][com][dot][ar

.:: LEGAL NOTICES

Copyright (c) 2007 by [ISR] Infobyte Security Research.
Permission to redistribute this alert electronically is granted as long as it 
is not
edited in any way unless authorized by Infobyte Security Research Response.
Reprinting the whole or part of this alert in any medium other than 
electronically
requires permission from infobyte com ar

Disclaimer
The information in the advisory is believed to be accurate at the time of 
publishing
based on currently available information. Use of the information constitutes 
acceptance
for use in an AS IS condition. There are no warranties with regard to this 
information.
Neither the author nor the publisher accepts any liability for any direct, 
indirect, or
consequential loss or damage arising from use of, or reliance on, this 
information.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iQEVAwUBSGvqefr3+fypwNnjAQLsawf/eNzyFnlo5MgWhZUTIlvfbAj7C5OtVYBm
+uVGOxG4ljtfYj7R5UPkHMUxXKOGDjbkeot0ohOgxhW3WD7IgkSe9Ionkmjpkvv9
FoKPKtMcSOctx6oGcqOAHYjz96Biiu5OzC/2yullLoP6PRgO2PKYRD8iYMa2DSla
vQXgrA3svfuKId7fF3PMtXqbI+mwqHFS+3zQNE4vwDU7gaMGRqSvK3BswgD/uuxo
JM5bjREjwCEA7i3/qdGlFHNaRXr/6sIWSsjORenhAefGMmaJiwFFBYY1IPcL4EDn
bRv9JSToQ5xImGgLCVRk77VliZGz31zRGwsA3ue05XHFN4NYU6YvjA==
=Uw2K
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists