Netscape Enterprise Server SSL Buffer Overflow DoS Vulnerability

Bugtraq ID:	516
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jul 06 1999 12:00AM
Updated:	Jul 06 1999 12:00AM
Credit:	Posted to NTBugtraq July 6, 1999 by Arne Vidstrom <[email protected]>.
Vulnerable:	Netscape Enterprise Server 3.51 - Digital UNIX 4.0 D - HP HP-UX 10.10 - IBM AIX 4.1.5 - Microsoft Windows NT 4.0 - SGI IRIX 6.2 - Sun Solaris 2.5.1 Netscape Enterprise Server 3.6 - Compaq Tru64 4.0 d - Digital UNIX 4.0 B - HP HP-UX 11.0 - IBM AIX 4.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 - SGI IRIX 6.5 - SGI IRIX 6.2 - Sun Solaris 2.5.1 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 Netscape Enterprise Server 3.0 - Compaq Tru64 4.0 d - HP HP-UX 11.0 - IBM AIX 4.2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - SGI IRIX 6.5 - Sun Solaris 7.0 - Sun Solaris 2.6_sparc
Not Vulnerable:

Netscape Enterprise Server SSL Buffer Overflow DoS Vulnerability

x

• /data/vulnerabilities/exploits/nesexploit.c

Netscape Enterprise Server SSL Buffer Overflow DoS Vulnerability

Solution:
Netscape has provided a downloadable, patched version at:
http://help.netscape.com/business/filelib.html#SSLHandshake

Netscape Enterprise Server SSL Buffer Overflow DoS Vulnerability

References:

• Enterprise Server 3.6 ServicePack2 with SSL handshake patch (Netscape)