Check Point Advisories

Novell iManager Tomcat HTTP POST Request Handling Denial of Service (CVE-2006-4517)

Vulnerability
Protection

Check Point Reference:	CPAI-2006-272
Date Published:	25 Nov 2009
Severity:	High
Last Updated:	Wednesday 25 November, 2009
Source:
Industry Reference:	CVE-2006-4517
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Novell iManager is a web-based administration console that provides management of many other Novell products. During installation, if the Windows Web Publishing Services (IIS) is not available, the installation program will install the Apache HTTP server. The iManager service itself is a Java web application running on top of the Tomcat application container. A denial of service vulnerability exists in the Novell iManager Tomcat HTTP server component. The vulnerability is due to a failure to verify user supplied data in incoming HTTP POST requests. A remote unauthenticated attacker can exploit this vulnerability to terminate the affected service. Upon a successful attack, the affected Tomcat service will terminate abnormally. The server will be unresponsive until the Tomcat service is manually restarted.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Novell iManager Tomcat HTTP POST Request Handling Denial of Service protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Web Server Enforcement Violation.
Attack Information: Novell iManager Tomcat HTTP POST request handling denial of service