Memory Corruption in Novell GroupWise Messenger

vendor:

GroupWise Messenger

by:

Luigi Auriemma

7,5

CVSS

HIGH

Memory Corruption

119

CWE

Product Name: GroupWise Messenger

Affected Version From: <= 2.1.0

Affected Version To: <= 2.1.0

Patch Exists: YES

Related CWE: N/A

CPE: a:novell:groupwise_messenger

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, NetWare

2012

Memory Corruption in Novell GroupWise Messenger

nmma.exe is a service running on port 8300. The NM_A_PARM1 tag of the 'login' command is the base64 of the 'username::password' string encrypted with blowfish. This tag has the value 10 which is relative to the strings, but exists another type defined as 12 which instead is used for particular data ('nested arrays') and when used for login->NM_A_PARM1 allows to corrupt the heap memory. Through additional packets before and after the malformed one (the service is multi-thread) may be possible to control the memory and execute arbitrary code.

Mitigation:

Upgrade to the latest version of Novell GroupWise Messenger

Source

Exploit-DB raw data:

#######################################################################

                             Luigi Auriemma

Application:  Novell GroupWise Messenger
              http://www.novell.com/products/groupwise/
Versions:     <= 2.1.0
Platforms:    Windows, Linux, NetWare
Bug:          memory corruption
Exploitation: remote, versus server
Date:         16 Feb 2012 (found 10 May 2011)
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Check vendor's homepage and version because this is an old advisory.


#######################################################################

======
2) Bug
======


nmma.exe is a service running on port 8300.

The NM_A_PARM1 tag of the "login" command is the base64 of the
"username::password" string encrypted with blowfish.

This tag has the value 10 which is relative to the strings, but exists
another type defined as 12 which instead is used for particular data
("nested arrays") and when used for login->NM_A_PARM1 allows to corrupt
the heap memory:

  0042BCD9  |. 8B0B           MOV ECX,DWORD PTR DS:[EBX]        ; 3
  0042BCDB  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]      ; 3
  0042BCDE  |. C1EE 02        SHR ESI,2                         
  0042BCE1  |. 81C6 55555555  ADD ESI,55555555
  0042BCE7  |. 8D0476         LEA EAX,DWORD PTR DS:[ESI+ESI*2]
  0042BCEA  |. 50             PUSH EAX                          ; 0xffffffff
  0042BCEB  |. 51             PUSH ECX                          ; heap
  0042BCEC  |. 52             PUSH EDX                          ; context
  0042BCED  |. E8 5E0E0000    CALL nmma.0042CB50                ; blowfish

Through additional packets before and after the malformed one (the
service is multi-thread) may be possible to control the corruption.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/nmma_x.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18489.zip (nmma_x.zip)

nmma_x 1 SERVER


#######################################################################

======
4) Fix
======


No fix.


#######################################################################