Netware IPX Admin Session Spoof Vulnerability
BID:528
Info
Netware IPX Admin Session Spoof Vulnerability
| Bugtraq ID: | 528 |
| Class: | Configuration Error |
| CVE: |
CVE-1999-1086 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jul 15 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | NMRC advisory posted to Bugtraq on July 16, 1999 by Simple Nomad |
| Vulnerable: |
Novell Netware 5.0 Novell Netware 4.11 SP5B Novell Netware 4.1 |
| Not Vulnerable: | |
Discussion
Netware IPX Admin Session Spoof Vulnerability
Novell has a packet signature mechanism to verify the source of certain types of packets. This mechanism can be configured to be used always (level 3), if possible by the other side (level 2), if requested by the other side (level 1), or never (level 0). Unless the signature level is set to 3, IPX fragmented requests/replies (NCP call 0x68) are not signed. If the client is set at 1, part of a session can be spoofed. If the session is an Admin session, Admin privileges can be gained.
Novell has a packet signature mechanism to verify the source of certain types of packets. This mechanism can be configured to be used always (level 3), if possible by the other side (level 2), if requested by the other side (level 1), or never (level 0). Unless the signature level is set to 3, IPX fragmented requests/replies (NCP call 0x68) are not signed. If the client is set at 1, part of a session can be spoofed. If the session is an Admin session, Admin privileges can be gained.
Exploit / POC
Netware IPX Admin Session Spoof Vulnerability
The NMRC Pandora program includes the exploit for this. The following is a description of how the exploit works, quoted from the NMRC advisory:
0. Admin client is Packet Signature Level 1, and server is Packet Signature Level 3.
1. Attack box gets Admin's MAC address, and inserts it into the Pandora Online tool. Attacker has the option to adjust other parameters as needed, but the main one is the MAC address.
2. Admin performs actions dealing with NDS that use fragmented packets (normal administrator activity will give us the needed packets quickly). 3. Attack box sends forged request to server, making us security equivalent to Admin.
4. Netware 5 server accepts forged packets.
5. Admin client loses connection from server as its packet sequence is now out of whack.
6. Attacker adjusts security settings for self so that the attacker has full access to entire tree, and removes "equal to Admin", so s/he will not show up on a basic "who's equiv to me" investigation by Admin.
Caveats:
0. This attack will fail in a switched environment since sniffing is involved.
1. This is a race. If the Admin client beats the attacker, the attacker must try again.
2. Obviously the attacker being on the same Ethernet segment as the Admin will help considerably in an attack. In theory this should work if you are anywhere in between the Admin client and the server, although you will need to use the MAC address of the router interface the Admin's session is coming from. At best, this may not work at all, but is still theoretically possible.
3. In theory this could be adapted to a Netware/IP environment, as Novell's TCP/IP stack is vulnerable to sequence number prediction. We have not explored adapting Pandora exploit code over to a pure IP environment, but will explore this possibility in future Pandora releases.
The NMRC Pandora program includes the exploit for this. The following is a description of how the exploit works, quoted from the NMRC advisory:
0. Admin client is Packet Signature Level 1, and server is Packet Signature Level 3.
1. Attack box gets Admin's MAC address, and inserts it into the Pandora Online tool. Attacker has the option to adjust other parameters as needed, but the main one is the MAC address.
2. Admin performs actions dealing with NDS that use fragmented packets (normal administrator activity will give us the needed packets quickly). 3. Attack box sends forged request to server, making us security equivalent to Admin.
4. Netware 5 server accepts forged packets.
5. Admin client loses connection from server as its packet sequence is now out of whack.
6. Attacker adjusts security settings for self so that the attacker has full access to entire tree, and removes "equal to Admin", so s/he will not show up on a basic "who's equiv to me" investigation by Admin.
Caveats:
0. This attack will fail in a switched environment since sniffing is involved.
1. This is a race. If the Admin client beats the attacker, the attacker must try again.
2. Obviously the attacker being on the same Ethernet segment as the Admin will help considerably in an attack. In theory this should work if you are anywhere in between the Admin client and the server, although you will need to use the MAC address of the router interface the Admin's session is coming from. At best, this may not work at all, but is still theoretically possible.
3. In theory this could be adapted to a Netware/IP environment, as Novell's TCP/IP stack is vulnerable to sequence number prediction. We have not explored adapting Pandora exploit code over to a pure IP environment, but will explore this possibility in future Pandora releases.
Solution / Fix
Netware IPX Admin Session Spoof Vulnerability
Solution:
Quoted verbatim from the NMRC advisory:
Use Packet Signature Level 3 everywhere, and make sure clients cannot touch their own signature settings. LAN Admins should never access a server unless using Level 3, and the security on the workstation should be restrictive enough to prevent unauthorized adjustments (i.e. use a locked-down NT client with no server services running, behind a locked door, although this simply places your trust in Microsoft). Use switched Ethernet.
Solution:
Quoted verbatim from the NMRC advisory:
Use Packet Signature Level 3 everywhere, and make sure clients cannot touch their own signature settings. LAN Admins should never access a server unless using Level 3, and the security on the workstation should be restrictive enough to prevent unauthorized adjustments (i.e. use a locked-down NT client with no server services running, behind a locked door, although this simply places your trust in Microsoft). Use switched Ethernet.