|| || [ISR] || Infobyte Security Research || www.infobyte.com.ar || 07.02.2008 || .:: SUMMARY Novell GroupWise Messenger Client (GWIM) Remote Stack Overflow Version: 2.0, It is suspected that all previous versions of Groupwise Messenger Client are vulnerable. .:: BACKGROUND Novell GroupWise Messenger is a corporate instant messaging product that uses Novell eDirectory? as its user database More info: http://www.novell.com .:: VULNERABILITY VIDEO DEMO http://www.infobyte.com.ar/demo/ISR_groupwise_messenger.html .:: POC ISR-groupwisemsn.pl, simple fake groupwise msn server. http://www.infobyte.com.ar/developments.html .:: DESCRIPTION Issue 1: ------- This issue is due to a failure of the application to securely parse the server's response. The application server works similarly to HTTP protocol, default tcp port 8300. The server always response the client's request with something like this: " HTTP/1.0 200 \r Date: xxx, xx xxx xxxx xx:xx:xx GMT\r Pragma: no-cache\r Cache-Control: no-cache\r \r %VALUES% \0\0\0 \0\24\0\0\0NM_A_SZ_RESULT_CODE\0\2\0\0\x000\0 \0\27\0\0\0NM_A_SZ_TRANSACTION_ID\0\2\0\0\x001\0\0 " If the client application receive a server response to any request like the following, a stack overflow is occurred: " HTTP/1.0 200 \r Date: xxx, xx xxx xxxx xx:xx:xx GMT\r Pragma: no-cache\r Cache-Control: no-cache\r \r %VALUES% \0\0\0 \0\24\0\0\0NM_A_SZ_RESULT_CODE\0\2\0\0\x000\0 \0\27\0\0\0NM_A_SZ_TRANSACTION_ID\0\2\0\0\x001\0\0"+ "AAAAAAAAAA...." x 5000 Issue 2: ------ We found another stack overflow regarding the client's popup alerts, when you receive a message of another user the server send a string like this to the client: "l\0\0\x001\0\0\0CN=XXXX,OU=XX,OU=XXXX,OU=XX,OU=XX,O=INFOBYTEXX\0'\0\0\0[87 1F8247-4B110000-0A01C80A-6C20-010 0]\0\1\0\0\0\xE4\0\0\0{\\rtf1\\fbidis\\ansi\\ansicpg1252\\deff0\\deflang308 2{\\fonttbl{\\f0\\fswiss\\fprq2\\fcharset0 fontname;}}\r\n{\\colortbl;\\red0\\green0\\blue0;}\r\n\\viewkind4\\uc1\\par d\\ltrpar\\li50\\ri50\\cf1\\f0\\fs20 MESSAGE\\par\r\n}\r\n\0"; If a client receive a string like this but in any place of the string it's added an "A" x 5000 you have another stack overflow. .:: IMPACT Both vulnerabilities permit arbitrary code execution. .:: VENDOR RESPONSE Vendor advisory: http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5026700.html .:: CVE INFORMATION Id: CVE-2008-2703, CVE-2008-2704 Web: http://cve.mitre.org .:: DISCLOSURE TIMELINE 01/12/2008 Initial vendor notification 01/13/2008 Initial vendor response notify research 06/10/2008 Coordinated public disclosure .:: CREDIT Francisco Amato is credited with discovering this vulnerability. famato][at][infobyte][dot][com][dot][ar .:: LEGAL NOTICES Copyright (c) 2008 by [ISR] Infobyte Security Research. Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Infobyte Security Research Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from infobyte com ar Disclaimer The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
