Novell Netware Enterprise Web Server CGI2Perl.NLM Buffer Overflow Vulnerability

Bugtraq ID:	8251
Class:	Boundary Condition Error
CVE:	CVE-2003-0562
Remote:	Yes
Local:	No
Published:	Jul 23 2003 12:00AM
Updated:	Jul 11 2009 10:56PM
Credit:	Discovery of this vulnerability has been credited to Uffe Nielsen.
Vulnerable:	Novell Netware 6.0 SP2 Novell Netware 6.0 SP1 Novell Netware 6.0 Novell Netware 5.1 SP6 Novell Netware 5.1 SP4 Novell Netware 5.1
Not Vulnerable:

Novell Netware Enterprise Web Server CGI2Perl.NLM Buffer Overflow Vulnerability

Novell Netware Enterprise Web Server cgi2perl.nlm has been reported prone to a buffer overflow vulnerability.

The issue presents itself, likely due to insufficient bounds checking performed on user-supplied data. It has been reported that a remote attacker may send data in a manner sufficient to trigger the condition, and cause one or more server ABEND conditions.

Novell Netware Enterprise Web Server CGI2Perl.NLM Buffer Overflow Vulnerability

Solution:
The vendor has released a fix to address this issue, customers who are affected by this vulnerability are advised to download and apply the patch. See referenced advisory for further details.


Novell Netware 5.1 SP4

• Novell cgiperl71903.exe
  http://support.novell.com/cgi-bin/search/searchtid.cgi?/2966549.htm

Novell Netware 5.1 SP6

• Novell cgiperl71903.exe
  http://support.novell.com/cgi-bin/search/searchtid.cgi?/2966549.htm

Novell Netware 5.1

• Novell cgiperl71903.exe
  http://support.novell.com/cgi-bin/search/searchtid.cgi?/2966549.htm

Novell Netware Enterprise Web Server CGI2Perl.NLM Buffer Overflow Vulnerability

References:

• CGI2PERL 7-19-03 - TID2966549 (Novell)
  
• Buffer Overflow in Netware Web Server PERL Handler ("Uffe Nielsen" )