Exploit-DB #14010
Description: Novell iManager - Multiple Vulnerabilities
Type: dos
Platform: novell
Date: 2010-06-24
Author: Core Security Technologies

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
      Core Security Technologies - CoreLabs Advisory
            http://corelabs.coresecurity.com/

        Novell iManager Multiple Vulnerabilities



1. *Advisory Information*

Title: Novell iManager Multiple Vulnerabilities
Advisory Id: CORE-2010-0316
Advisory URL:
[http://www.coresecurity.com/content/novell-imanager-buffer-overflow-off-by-one-vulnerabilities]
Date published: 2010-06-23
Date of last update: 2010-06-23
Vendors contacted: Novell
Release mode: User release



2. *Vulnerability Information*

Class: Stack-based buffer overflow [CWE-119], Off-by-one error [CWE-193]
Impact: Code execution, Denial of service
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2010-1929, CVE-2010-1930
Bugtraq ID: 40480, 40485



3. *Vulnerability Description*

Novell iManager is a Web-based administration console that provides
customized secure access to network administration utilities and
content from any location in the world. With iManager you can manage
Novell Open Enterprise Server, Novell Identity Manager, Novell
eDirectory and many other Novell and third-party services from a web
browser. Novell iManager is prone to a stack-based buffer overflow
vulnerability that can be exploited by authenticated users to execute
arbitrary code, and to an off-by-one error that can be abused by
remote, unauthenticated attackers to cause a Denial of Service to the
application.


4. *Vulnerable packages*

   . Novell iManager 2.7
   . Novell iManager 2.7.3
   . Novell iManager 2.7.3 FTF2
   . Older versions are probably affected too, but they were not checked.


5. *Non-vulnerable packages*

   . Novell iManager 2.7.3 ftf4
   . Novell iManager 2.7.4


6. *Vendor Information, Solutions and Workarounds*

Novell has a planned release of iManager 2.7.4 in August 2010; this
release should fix these issues. The Novell team notifies they will
provide patches for the current vulnerable versions with the 2.7.3
ftf4 release before August, but this release was not confirmed yet
(see the timeline for more details). In the meantime, users can
mitigate these flaws by applying these countermeasures:

   1. For [CVE-2010-1929 | 40480], establish a Web Application
Firewall rule for limiting the length of the parameters
'EnteredClassID' and 'NewClassName' in POST requests to the URI
'/nps/servlet/webacc/'.
   2. For [CVE-2010-1930 | 40485], establish a Web Application
Firewall rule for limiting the length of the parameter 'Tree' in POST
requests to the URI '/nps/servlet/webacc/'.

 Similar rules can also be established in the Apache webserver of the
iManager installation in order to mitigate these flaws.


7. *Credits*

This vulnerability was discovered and researched by Francisco Falcon
from Core Security Technologies.


8. *Technical Description / Proof of Concept Code*


8.1. *Introduction*

Novell iManager [1] is a Web-based administration console that
provides customized secure access to network administration utilities
and content from any location in the world. With iManager you can
manage Novell Open Enterprise Server, Novell Identity Manager, Novell
eDirectory and many other Novell and third-party services from a web
browser. Novell iManager is prone to a stack-based buffer overflow
vulnerability that can be exploited by authenticated users to execute
arbitrary code, and to an off-by-one error that can be abused by
remote, unauthenticated attackers to cause a Denial of Service to the
application. These two vulnerabilities are described below.


8.2. *Stack-based Buffer Overflow*

[CVE-2010-1929 | 40480] Novell iManager provides a feature to create
classes, under the 'Schema' menu. The class name is intended to have a
maximum length of 32 characters. This limitation is enforced on the
client side by setting a 'maxlength' property with a value of 32 in
the proper form field, but no verification is performed on the server
side to ensure that the user-defined class name is, at most, 32
characters long. By tampering the POST request that sends the class
name when creating a new class, an authenticated user can define an
overly long class name that will cause a stack-based buffer overflow
on the iManager web server, making it possible for the attacker to
overwrite return addresses and Structured Exception Handlers, allowing
the execution of arbitrary code with the privileges of the current
user (in the case of iManager Workstation) or with SYSTEM privileges
(in the case of iManager Server).

On the server side, the creation of a new class is handled by the
'jclient._Java_novell_jclient_JClient_defineClass () 20' function, in the
'jclient.dll' module of the iManager Tomcat web server. This function
in turn invokes a subroutine that copies the user-defined class name
to a fixed-size buffer in the stack, without checking its length. The
following disassembled code of the Novell iManager Tomcat web server
illustrates the vulnerability.

/-----
[jvm.dll + 0x1055CC]

6D9B55CC  |.  8B7D 18       MOV EDI,DWORD PTR
SS:[EBP+18]                    ;  edi = destination buffer in the stack
6D9B55CF  |.  83E1 3F       AND ECX,3F
6D9B55D2  |.  D3E0          SHL EAX,CL
6D9B55D4  |.  8D7472 0C     LEA ESI,DWORD PTR
DS:[EDX+ESI*2+C]               ;  esi = pointer to class name
6D9B55D8  |.  8BC8          MOV
ECX,EAX                                      ;  ecx = length of class name
6D9B55DA  |.  8BD1          MOV EDX,ECX
6D9B55DC  |.  C1E9 02       SHR ECX,2
6D9B55DF  |.  F3:A5         REP MOVS DWORD PTR ES:[EDI],DWORD PTR
DS:[ESI]   ;  *BUFFER OVERFLOW*

- -----/



8.3. *Off By One Error (DoS)*

[CVE-2010-1930 | 40485] There is an off-by-one error in the code that
handles the login process that can be abused by remote,
unauthenticated users to crash the iManager web server, thus denying
the service to legitimate users.