iDEFENSE Security Advisory 10.16.02:
http://www.idefense.com/advisory/10.16.02.txt
Denial of Service in Sabre Desktop Reservation Client for Windows
October 16, 2002

I. BACKGROUND

Sabre Inc.’s Desktop Reservation Software for Windows is a legacy
travel agency program that has since been replaced by Sabre eVoya
software. However, several travel agencies and major airline travel
call centers still use this software.

II. DESCRIPTION

Sabre Desktop Reservation Software for Windows has a component called
Sabserv (listening on TCP port 1001) that connects the client
application to the communication components and eventually to the
local Sabre gateway at the local site. If Sabserv is sent arbitrary
data on TCP port 1001 that it does not understand, it will stop
functioning within one minute, usually. The client application will
no longer have access to Sabre or the gateway. The gateway
application is unaffected by this vulnerability and all other users
on the local system will continue to have connectivity.

III. ANALYSIS

Local exploitation at an airline call center or travel agency could
potentially slow or halt production. Under heavy load, the client
will lock up, thereby forcing a reboot. This causes a loss of
productivity, particularly in a high-volume call center. Automated
ticketing systems running this client can be crashed as well. Since
some companies using this software may not regularly monitor such
events, they could miss ticketing deadlines, thereby having to pay
out of pocket for ticket price changes or penalties

IV. DETECTION

This issue was tested on Sabre Desktop Reservation Software for
Windows 4.2, 4.3, and 4.4 on Windows 95 and 98SE, with all the latest
patches installed.

V. RECOVERY

Restarting the application should restore normal functionality.

VI. VENDOR FIX/RESPONSE

Sabre responded with the following statement:

"Sabserv will be updated to ignore data it does not understand as
part of the next maintenance upgrade to Sabre Desktop Reservation
Software for Windows. This will prevent the denial of service
condition within the client application when arbitrary data is sent
to port 1001."

VII. CVE INFORMATION

The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project
has assigned the identification number CAN-2002-1191 to this issue.

VIII. DISCLOSURE TIMELINE

07/26/2002	Issue disclosed to iDEFENSE
08/26/2002	Disclosed to vendor via e-mail to support@sabre.com
08/26/2002	Disclosed to iDEFENSE clients
09/03/2002	Second attempt at e-mail contact
09/15/2002	Call to Sabre technical support rep N2H, referred to
customer support representative
09/20/2002	Fourth attempt at contact (leslie.price@sabre.com)
09/23/2002	Response received from Leslie Price
09/23/2002	Response received from Jeff Harmon (jeff.harmon@sabre.com)
10/10/2002	Coordinated public disclosure

IX. CREDIT

Altomo (adame780@bellsouth.net) is credited with discovering this
vulnerability.


Get paid for security research
http://www.idefense.com/contributor.html

Subscribe to iDEFENSE Advisories:
send email to listserv@idefense.com, subject line: "subscribe"


About iDEFENSE:

iDEFENSE is a global security intelligence company that proactively
monitors sources throughout the world — from technical
vulnerabilities and hacker profiling to the global spread of viruses
and other malicious code. Our security intelligence services provide
decision-makers, frontline security professionals and network
administrators with timely access to actionable intelligence and
decision support on cyber-related threats. For more information,
visit http://www.idefense.com.


- -dave

David Endler, CISSP
Director, Technical Intelligence
iDEFENSE, Inc.
14151 Newbrook Drive
Suite 100
Chantilly, VA 20151
voice: 703-344-2632
fax: 703-961-1071

dendler@idefense.com
www.idefense.com


-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1.2
Comment: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4B0ACC2A

iQA/AwUBPa1yXUrdNYRLCswqEQITlwCfV3Ap77m8vUPKTYO1Yli3P2s+VTgAoOHK
J4ZiqHNEVt6Hsaz2SPlvCfFV
=8mlZ
-----END PGP SIGNATURE-----