BID:3826

Netscape Enterprise Server Web Publisher DoS Vulnerability

Info

Netscape Enterprise Server Web Publisher DoS Vulnerability

Bugtraq ID:	3826
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jan 09 2002 12:00AM
Updated:	Jan 09 2002 12:00AM
Credit:	Discovered by Richard Brain and published in ProCheckUp Security Bulletin PR01-04. Published in CERT Vulnerability Note VU#191763.
Vulnerable:	Netscape Enterprise Server 3.6 - Compaq Tru64 4.0 d - Digital UNIX 4.0 B - HP HP-UX 11.0 - IBM AIX 4.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 - SGI IRIX 6.5 - SGI IRIX 6.2 - Sun Solaris 2.5.1 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 Netscape Enterprise Server 3.5 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6_sparc Netscape Enterprise Server 3.4 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6_sparc Netscape Enterprise Server 3.3 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6_sparc Netscape Enterprise Server 3.2 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6_sparc Netscape Enterprise Server 3.1 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6_sparc Netscape Enterprise Server 3.0 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 7.0 - Sun Solaris 2.6_sparc iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.1 - Compaq Tru64 5.1 - Compaq Tru64 5.0 a - HP HP-UX 11.0 - HP HP-UX 11i v1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Redhat Linux 6.2 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 iPlanet E-Commerce Solutions iPlanet Web Server Enterprise Edition 4.0 - Compaq Tru64 5.1 - Compaq Tru64 5.0 a - HP HP-UX 11.0 - HP HP-UX 11i v1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Redhat Linux 6.2 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6

Not Vulnerable:

Discussion

Netscape Enterprise Server Web Publisher DoS Vulnerability

Netscape Enterprise Server is a web server used to host larger-scale websites. A Web Publishing feature is installed by default. The Enterprise Server runs on Microsoft and most Unix and Linux platforms.

A denial of service condition has been reported when Web Publishing is enabled.

Submitting a malformed '?wp-html-rend' request to a host running the server, will achieve the denial of service condition.

It should be noted that this issue has only been known to work on Microsoft Windows NT or 2000 hosts. In addition, iPlanet Web Server Enterprise Edition is also vulnerable to this issue.

Exploit / POC

Netscape Enterprise Server Web Publisher DoS Vulnerability

No exploit code is required.

Solution / Fix

Netscape Enterprise Server Web Publisher DoS Vulnerability

Solution:
iPlanet has released the following files which will disable the wp-html-rend command:

Netscape Enterprise Server 3.0