GSNW error message 1

[cbarrol]

Hello,

I had a wierd message box pop up on the 2000 server this morning (and I cant get rid of it). The header of the message box reads "Gateway Service for Netware" and the message reads:
"Message from server"
O O

I found two relative MS hotfixes, installed them & rebooted the server:

http://www.microsoft.com/technet/security/Bulletin/MS06-066.mspx

http://www.symantec.com/avcenter/attack_sigs/s21386.html

The message box comes back upon reboot.
We DO use GSNW on that machine.

Has anyone ever seen this, or can anyone offer any suggestions?
Thank You,
Craig Barroll

 

[ITPangaeaArchitect]

I assume youve uninstalled and reinstalled/reconfigured GSNW attemtping to fix this?

What version of Netware on the other end?

-Brandon Wilson
MCSE00/03, MCSA:Messaging00, MCSA03, A+
Sr. Infrastructure Management Analyst
Distributed Systems Engineering
ACS, Inc.

 

[cbarrol]

Brandon,

Thanks for the quick response.
Negative on the reinstall/reconfig of GSNW. Netware V.6 on the other end. BTW, the message almost resembles a "net send" message with jibberish (the two characters that look like OO) The info I found online with one of the hot-fixes referred to:

"A remote attacker can exploit this vulnerability by sending a malformed message to the Client Service. This message would likely contain excessive data that is sufficient to overflow a finite sized buffer and corrupt process memory. A remote attacker can exploit this vulnerability to execute arbitrary code and completely compromise the computer. This issue could also be exploited by local attackers to gain elevated privileges."

I thought the hot-fix would solve the problem but it did not.

 

[ITPangaeaArchitect]

my initial thought when i read this post was cycle the server and workstation service (shut the system down for about 10 minutes is easiest..ensure all packets that may have been incoming from a malicious person time out), uninstall GSNW completely, reapply the hotfix (assuming it allows install without GSNW installed), then reinstall/reconfigure GSNW....the cycling of services or the shutdown being a safety precaution if it were me personally i would do it just to see if it resolves anything, at least

If someone did exploit this system, it will be best to reset major passwords on the Novell and Windows side (administrator, and admins resetting theirs, just in case)..

-Brandon Wilson
MCSE00/03, MCSA:Messaging00, MCSA03, A+
Sr. Infrastructure Management Analyst
Distributed Systems Engineering
ACS, Inc.

 

[cbarrol]

Brandon,

The popup went away last evening almost as mysteriously as it appeared, about 3 hours AFTEr I applied the hot-fixes and rebooted, and has not reappeared since. We did do a netstat -an and did not see any evidence of an external connection. Thanks for the feedback.

 

[ITPangaeaArchitect]

that is very interesting

glad to hear your good now

-Brandon Wilson
MCSE00/03, MCSA:Messaging00, MCSA03, A+
Sr. Infrastructure Management Analyst
Distributed Systems Engineering
ACS, Inc.