Novell Border Manager Audit Trail Proxy DoS Vulnerability

Bugtraq ID:	976
Class:	Design Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Feb 04 2000 12:00AM
Updated:	Feb 04 2000 12:00AM
Credit:	Posted to Bugtraq on February 8, 2000 by "Chicken Man" <[email protected]>.
Vulnerable:	Novell BorderManager 3.5 - Novell Netware 5.0 Novell BorderManager 3.0 - Novell Netware 5.0 - Novell Netware 4.11
Not Vulnerable:

Novell Border Manager Audit Trail Proxy DoS Vulnerability

A feature called the CS Audit Trail Proxy is installed by default with BorederManager 3.0 and 3.5 .This feature opens a listening port at port 2000, on both the internal and external interfaces. If a connection is made to this port and the 'enter' key hit a few times, the server will start experincing memory allocation problems. Eventually the server will have to be rebooted to restore normal functionality.

The CS Audit Trail Proxy is handled by CSATPRX.NLM

Novell Border Manager Audit Trail Proxy DoS Vulnerability

see discussion

Example:
telnet target:2000
<enter>
<enter>

Novell Border Manager Audit Trail Proxy DoS Vulnerability

Solution:
Novell has released a patch which limits the memory csatpxy.nlm uses to 100k/session. It is available at:
http://support.novell.com/cgi-bin/search/find_file?FileName=csatpxy1.exe

Novell Border Manager Audit Trail Proxy DoS Vulnerability

References:

• BorderManager Tech Support Page (Novell)
  
• Novell Knowledgebase: CSATPXY.NLM abends the server (Novell)