CVE-2005-2852
published 2005-09-08CVE-2005-2852: Unknown vulnerability in CIFS.NLM in Novell Netware 6.5 SP2 and SP3, 5.1, and 6.0 allows remote attackers to cause a denial of service (ABEND) via an incorrect…
PriorityP432medium5CVSS 2.0
AVNACLAuNCNINAP
EXPLOIT
EPSS
40.26%
98.5th percentile
Unknown vulnerability in CIFS.NLM in Novell Netware 6.5 SP2 and SP3, 5.1, and 6.0 allows remote attackers to cause a denial of service (ABEND) via an incorrect password length, as exploited by the "worm.rbot.ccc" worm.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| novell | netware | — | — |
| novell | netware | — | — |
| novell | netware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring for SMB named pipe connections to \lsarpc combined with DCE/RPC opcode 0x0E (LsarLookupNames) carrying an oversized Unicode string (~0xa0+ bytes) on NetWare CIFS targets. ↗
- →The exploit sends a malformed password length field via CIFS; monitor for ABEND (abnormal end) events on Novell NetWare CIFS.NLM, which is the primary DoS/crash indicator for both the worm and exploit. ↗
- →The exploit disables DCE/RPC multi-bind (DCERPC::fake_bind_multi = false) before binding to the LSARPC interface; this non-standard bind sequence over SMB to NetWare hosts can be used as a detection signal. ↗
- →The ROP return addresses in libc.nlm (e.g. 0xb2329b98, 0xb234a268, 0xbabc286c, 0xbabc9c3c, 0x823c835c, 0x823c83fc) are version-specific 'push esp; ret' gadgets; presence of these 4-byte little-endian values in SMB/DCE-RPC payloads targeting NetWare is a strong exploit indicator. ↗
- →NetWare SP version can be fingerprinted via SNMP (e.g. 5.70.07 = NetWare 6.5 SP7); correlate SNMP version strings with inbound SMB exploit attempts to identify targeted SP-specific return addresses. ↗
- ·The exploit targets the kernel-space CIFS.NLM driver; a failed exploit attempt will cause the OS to reboot, making testing against production systems extremely risky. ↗
- ·Payload space is constrained to 400 bytes and null bytes (0x00) are bad characters, limiting shellcode options. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Novell NetWare - LSASS CIFS.NLM Driver Stack Buffer Overflow (Metasploit)
exploitdb·2010-05-09
CVE-2005-2852 Novell NetWare - LSASS CIFS.NLM Driver Stack Buffer Overflow (Metasploit)
Novell NetWare - LSASS CIFS.NLM Driver Stack Buffer Overflow (Metasploit)
---
##
# $Id: lsass_cifs.rb 9262 2010-05-09 17:45:00Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Novell NetWare LSASS CIFS.NLM Driver Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in the NetWare CIFS.NLM driver.
Since the driver runs in the kernel space, a failed exploit attempt can
cause the OS to reboot.
},
'Author' =>
[
'toto',
],
'License' => MSF_LICENSE,
'Version' => '$Revision: 9262 $',
'References' =>
[
[
Metasploit
Novell NetWare LSASS CIFS.NLM Driver Stack Buffer Overflow
metasploit
Novell NetWare LSASS CIFS.NLM Driver Stack Buffer Overflow
Novell NetWare LSASS CIFS.NLM Driver Stack Buffer Overflow
This module exploits a stack buffer overflow in the NetWare CIFS.NLM driver. Since the driver runs in the kernel space, a failed exploit attempt can cause the OS to reboot.
No writeups or analysis indexed.
http://support.novell.com/cgi-bin/search/searchtid.cgi?/2971821.htmhttp://support.novell.com/cgi-bin/search/searchtid.cgi?/2971822.htmhttp://support.novell.com/cgi-bin/search/searchtid.cgi?/2971832.htmhttp://support.novell.com/cgi-bin/search/searchtid.cgi?/2971821.htmhttp://support.novell.com/cgi-bin/search/searchtid.cgi?/2971822.htmhttp://support.novell.com/cgi-bin/search/searchtid.cgi?/2971832.htm
2005-09-08
Published