Novell NetWare NWFTPD Denial Of Service Vulnerability
BID:4693
Info
Novell NetWare NWFTPD Denial Of Service Vulnerability
| Bugtraq ID: | 4693 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2002-0791 |
| Remote: | Yes |
| Local: | No |
| Published: | May 08 2002 12:00AM |
| Updated: | Jul 11 2009 12:46PM |
| Credit: | Discovery of this issue is credited to Patrik Karlsson and Jonas Ländin. |
| Vulnerable: |
Novell Netware 6.0 SP1 Novell Netware 5.1 SP4 |
| Not Vulnerable: | |
Discussion
Novell NetWare NWFTPD Denial Of Service Vulnerability
NWFTPD is the FTP server for Novell NetWare.
NWFTPD is prone to a denial of service condition. It has been reported that the FTP server reacts unpredictably when a client sends a carriage return at the beginning of a connection. As a result, the server may consume a large amount of resources which may cause the underlying system to become unstable.
This issue has been reported for NWFTPD running on NetWare 6.0 SP 1. It has also been reported for NWFTPD running on NetWare 5.1 SP 4. Other versions may also be affected.
NWFTPD is the FTP server for Novell NetWare.
NWFTPD is prone to a denial of service condition. It has been reported that the FTP server reacts unpredictably when a client sends a carriage return at the beginning of a connection. As a result, the server may consume a large amount of resources which may cause the underlying system to become unstable.
This issue has been reported for NWFTPD running on NetWare 6.0 SP 1. It has also been reported for NWFTPD running on NetWare 5.1 SP 4. Other versions may also be affected.
Exploit / POC
Novell NetWare NWFTPD Denial Of Service Vulnerability
This may be exploited with a client utility such as netcat or telnet.
This may be exploited with a client utility such as netcat or telnet.
Solution / Fix
Novell NetWare NWFTPD Denial Of Service Vulnerability
Solution:
The vendor has supplied an upgraded version of the ftp server. It is required that Netware 6.0 SP1 or Netware 5.1 SP4 be installed before applying the upgrade.
Novell Netware 5.1 SP4
Novell Netware 6.0 SP1
Solution:
The vendor has supplied an upgraded version of the ftp server. It is required that Netware 6.0 SP1 or Netware 5.1 SP4 be installed before applying the upgrade.
Novell Netware 5.1 SP4
-
Novell nwftpd6.exe
http://support.novell.com/servlet/betafiledownload?file=/ftf/nwftpd6.e xe/
Novell Netware 6.0 SP1
-
Novell nwftpd6.exe
http://support.novell.com/servlet/betafiledownload?file=/ftf/nwftpd6.e xe/
References
Novell NetWare NWFTPD Denial Of Service Vulnerability
References:
References:
- NWFTPD.NLM High Utilization fix (Novell)