Rational ClearCase Portscan Denial Of Service Vulnerability

Bugtraq ID:	6228
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2002-1322
Remote:	Yes
Local:	No
Published:	Nov 22 2002 12:00AM
Updated:	Jul 11 2009 07:16PM
Credit:	Discovery of this vulnerability credited to Stefan Bagdohn and Marek Rouchal.
Vulnerable:	Rational Software ClearCase 2002.5 Rational Software ClearCase 4.1 - Caldera OpenUnix 8.0 - Caldera UnixWare 7 - Compaq Tru64 5.1 a - Compaq Tru64 5.1 - Compaq Tru64 5.0 f - Compaq Tru64 5.0 a - Compaq Tru64 5.0 - HP HP-UX 11.11 - HP HP-UX 11.0 - HP HP-UX 10.20 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - IBM AIX 5.1 - Redhat Linux 7.2 i386 - Redhat Linux 7.1 i386 - Redhat Linux 7.1 alpha - Redhat Linux 7.0 sparc - Redhat Linux 7.0 i386 - Redhat Linux 7.0 alpha - Redhat Linux 6.2 sparc - Redhat Linux 6.2 i386 - Redhat Linux 6.2 alpha - SGI IRIX 6.5.13 m - SGI IRIX 6.5.13 f - SGI IRIX 6.5.13 - SGI IRIX 6.5.12 m - SGI IRIX 6.5.12 f - SGI IRIX 6.5.12 - SGI IRIX 6.5.11 m - Siemens Reliant UNIX 5.45 - Siemens Reliant UNIX 5.44 - Siemens Reliant UNIX 5.43 - Sun Solaris 8_x86 - Sun Solaris 8_sparc - Sun Solaris 7.0_x86 - Sun Solaris 7.0 - Sun Solaris 2.6_x86 - Sun Solaris 2.6
Not Vulnerable:

Rational ClearCase Portscan Denial Of Service Vulnerability

Rational ClearCase has been reported to be prone to a denial of service condition. It is possible to cause this condition by portscanning a system running the vulnerable version of ClearCase. This issue was demonstrated using the nmap portscanning utility.

An attacker can exploit this vulnerability by making two consecutive portscans of a vulnerable system. This will cause ClearCase to crash. Restarting the ClearCase service is required to restore functionality.

Rational ClearCase Portscan Denial Of Service Vulnerability

The following proof of concepts were provided:

nmap -vvv -O -sT ip.of.clearcase.system
nmap -vvv -O -sT -p 371 ip.of.clearcase.system

Rational ClearCase Portscan Denial Of Service Vulnerability

Solution:
Patches are available:


Rational Software ClearCase 2002.5

• Rational clearcase_p2002.05.00-12.sun5.tar.gz
  http://www.rational.com/techsupport/clearcase/tech/patchlink/new/clear case/2002.05.00/clearcase_p2002.05.00-12/clearcase_p2002.05.00-12.sun5 .tar.gz


• Rational clearcase_p2002.05.00-15
  http://www.rational.com/techsupport/clearcase/tech/patchlink/new/clear case/2002.05.00/clearcase_p2002.05.00-15/


• Rational clearcase_p2002.05.00-16
  http://www.rational.com/techsupport/clearcase/tech/patchlink/new/clear case/2002.05.00/clearcase_p2002.05.00-16/

Rational ClearCase Portscan Denial Of Service Vulnerability

References:

• ClearCase Product Page (Rational)
  
• ClearCase DoS vulnerabilty ()