SecureXpert Labs Advisory [SX-98.12.30-01]

[sxdirect () SECUREXPERT COM (SecureXpert DIRECT Sender)]

SecureXpert Labs Advisory [SX-98.12.30-01]
This advisory updates advisory [SX-98.12.23-01]

DoS vulnerability in Novell Intranetware Client 3.0.0.0

Reported by: SecureXpert Labs


WARNING: this information is based on early analysis.  The subject matter
is still the subject of active research by SecureXpert Labs and others.
Legal: www.securexpert.com/legal.html


Summary

The previously reported Denial of Service vulnerability in Microsoft
Windows 98 has proven upon further investigation NOT to be a vulnerability
in the Microsoft Windows 98 product. Microsoft Windows 98, in a default
installation without third-party software, is not vulnerable to the attack
reported in [SX-98.12.30-01].

However, a vulnerability exists in the Novell Intranetware Client version
3.0.0.0 (as distributed with Novell Netware 5) which affects all Windows
95 and Windows 98 systems on which the Novell Intranetware Client version
3.0.0.0 is installed.

Windows 95 and Windows 98 systems with the Novell Intranetware Client
installed experience a critical error (Blue Screen) when scanned with the
popular port-scanner tool "nmap" (http://www.insecure.org/nmap) in
"half-open" scanning mode (-sS).

Specifically, the vulnerable service in the Intranetware client is the SLP
Request service on TCP port 427.  The command "nmap -sS -p427 target.com",
which scans only port 427 on the target system with a TCP half-open
sequence, causes an immediate Blue Screen condition.  This condition is
recoverable; however subsequently the affected system loses all TCP
network connectivity.  Similarly, any "nmap -sS" scan which includes port
427 in the range of scanned ports causes the same fault (on most systems
this includes the default scan with no ports specified).

The nmap tool includes features which permit it to scan large regions of
Internet address space.  Any Windows 95 or Windows 98 systems with the
Novell Intranetware Client installed found within any scanned region will
be affected.

Novell Inc. and Microsoft Corp. have received advance notice of this
vulnerability.

SecureXpert Labs wishes to thank Bruce Allison of Obsidian Networks for
his valuable assistance in the reproduction of this vulnerability.