Axent NetProwler Malformed IP Packets DoS Vulnerability

Bugtraq ID:	1225
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	Yes
Published:	May 18 2000 12:00AM
Updated:	May 18 2000 12:00AM
Credit:	Discovered by Rain Forest Puppy <[email protected]> and publicized in RFP2K05 advisory on May 18, 2000.
Vulnerable:	Axent Production NetProwler 3.0 - Microsoft Windows NT 4.0
Not Vulnerable:

Axent NetProwler Malformed IP Packets DoS Vulnerability

Axent NetProwler 3.0 IDS is vulnerable to a malformed packet attack. It will crash if the Man-in-the-Middle signature encounters a packet for which the following expression is true:
(IP_HEADER_LENGTH + TCP_HEADER_LENGTH) > IP_TOTAL_LENGTH

According to Axent Security team, this is not a fragmented packet issue as reported in RFP2K05 By Rain Forest Puppy.

In addition, NetProwler utilizes Microsoft JET engine 3.5 for storing incoming alert information. More information regarding the Microsoft JET engine 3.5 vulnerability can be found at:

http://www.securityfocus.com/bid/286

Axent NetProwler Malformed IP Packets DoS Vulnerability

Rain Forest Puppy <[email protected]> has released the exploit RFProwl.c. In addition, Pedro Quintanilha <[email protected]> posted a CASL script to Bugtraq which produces the same results as RFP's exploit:

• /data/vulnerabilities/exploits/RFProwl.c
• /data/vulnerabilities/exploits/netprowl.casl

Axent NetProwler Malformed IP Packets DoS Vulnerability

Solution:
Upgrade to NetProwler 3.5 (to be released in June 2000).

Axent NetProwler Malformed IP Packets DoS Vulnerability

References: