[NEWS] IBM Lotus Domino Server Web Service DoS Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 04/07/05

  • Next message: SecuriTeam: "[NEWS] Cisco Linksys WET11 Password Resetting" 
    To: list@securiteam.com
Date: 7 Apr 2005 10:06:09 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      IBM Lotus Domino Server Web Service DoS Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    IBM Lotus Domino Server software "provides messaging, calendaring and
    scheduling capabilities on a variety of operating systems".

    Remote exploitation of a denial of service vulnerability in IBM Corp.'s
    Lotus Domino Server web service allows attackers to crash the service,
    thereby preventing legitimate access.

    DETAILS

    Vulnerable Systems:
     * Lotus Domino Server version 6.5.1

    Immune Systems:
     * Lotus Domino Server version 6.5.3

    The problem specifically exists within the module NLSCCSTR.DLL. A
    recursive call loop is made continually when parsing the following example
    GET request:
        GET /cgi-bin/[xxx] HTTP/1.0
        Host: 10.10.0.100

    Where [xxx] represents a long string (~330) of UNICODE decimal value 430
    characters. The request triggers a stack exhaustion, which during testing
    against Lotus Domino Server version 6.5.1 occurred at the following
    instruction just prior to a call to NLSCCSTR.ucnv_toUnicode():
        6236B82B PUSH ECX

    This results in the immediate crash of nHTTP.EXE and is not reported to
    the NSERVER terminal. The crash occurs only when the long string is
    prefixed with /cgi-bin/, as Lotus Domino Server uses two different
    routines when handling requests made to the root directory and cgi-bin.
    Examining the call stack at the time of crash reveals the issue. The
    procedure NLSCCSTR.6236B080 is recursively called from the instruction at
    address NLSCCSTR.6236B73D. A condition that is checked earlier would JMP
    over this recursive call:
        PROCEDURE NLSCCSTR.6236B080 (Lotus Domino Server 6.5.1)
                ...
                6236B70D TEST EAX, EAX
            +-< 6236B70F JE SHORT NLSCCSTR.6236B77D
            | ...
            | 6236B73D CALL NLSCCSTR.6236B080
            | ...
            +-> 6236B77D MOV EAX, [EBP+20]

    Further up the call stack we can find the following originating calls with
    symbolic names:
        Procedure=NLSCCSTR.ccSTRCpyXlateExt
        Called from=NLSCCSTR.623DF3B8

        Procedure=nnotes.NLS_xlate_string32
        Called from=nnotes.60197A09

    While portions of the stack are overwritten with attacker-supplied data,
    gaining flow control to execute arbitrary code does not seem possible.

    Analysis:
    Exploitation of this vulnerability allows unauthenticated remote attackers
    to crash the web service, thereby preventing legitimate usage. This attack
    requires minimal resources to launch and can be repeated to ensure that an
    unpatched computer is unable to recover. A successful attack does not
    generate error messages in the NSERVER terminal. However, the nHTTP.exe
    process has indeed crashed.

    Restarting Domino Server will resume normal functionality.

    Workaround:
    Employ firewalls, access control lists or other TCP/UDP restriction
    mechanisms to limit access to systems and services.

    Vendor Status:
    IBM has released technote #1202446 for this issue. The vendor has been
    unable to reproduce the issue and has therefore not released any patches.
    iDEFENSE Labs testing has shown this product to be vulnerable to the issue
    described in this report. Customers should consider upgrading to Lotus
    Domino Server version 6.5.3, which iDEFENSE has confirmed as being not
    vulnerable.

    Disclosure Timeline:
    02/07/2005 - Initial vendor notification
    02/09/2005 - Initial vendor response
    04/06/2005 - Coordinated public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:idlabs-advisories@idefense.com> iDEFENSE.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?type=vulnerabilities>
    http://www.idefense.com/application/poi/display?type=vulnerabilities

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Cisco Linksys WET11 Password Resetting"

    Relevant Pages

    • [NEWS] Adobe Version Cue VCNative Multiple Vulnerabilities (Privileges Escalation, Symlink Attack)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... attackers to gain root privileges and perform a symlink attack using Adobe ... with user-supplied data. ...
      (Securiteam)
    • [NEWS] Gecko Based Browsers Multiple Vulnerabilities (Code Execution, Cross Site Scripting, Window S
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... that allow web sites to cause arbitrary code execution on users' system ... conduct spoofing and cross site scripting attacks. ... exploited by attackers to execute arbitrary code. ...
      (Securiteam)
    • [NT] Yahoo! Messenger Server Race Condition Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Yahoo! ... Messenger 6.0 ... Once the link is tweaked all the attackers need to do is plug it into ...
      (Securiteam)
    • [NT] WinPcap NPF.SYS bpf_filter_init Arbitrary Array Indexing Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WinPcap NPF.SYS bpf_filter_init Arbitrary Array Indexing Vulnerability ... making IOCTL requests with specially chosen values, attackers are able to ... The vulnerable device driver is loaded when WinPcap is initialized. ...
      (Securiteam)
    • [NT] Symantec Ghost Multiple DoS Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Symantec Ghost Multiple DoS Vulnerabilities ... Symantec Corp.'s Ghost allow remote attackers to crash the Ghost service. ...
      (Securiteam)