Denial of Service in Sabre Desktop Reservation Client for Windows

I. BACKGROUND

Sabre Inc.'s Desktop Reservation Software for Windows is a legacy travel agency program that has since been replaced by Sabre eVoya software. However, several travel agencies and major airline travel call centers still use this software.

II. DESCRIPTION

Sabre Desktop Reservation Software for Windows has a component called Sabserv (listening on TCP port 1001) that connects the client application to the communication components and eventually to the local Sabre gateway at the local site. If Sabserv is sent arbitrary data on TCP port 1001 that it does not understand, it will stop functioning within one minute, usually. The client application will no longer have access to Sabre or the gateway. The gateway application is unaffected by this vulnerability and all other
users on the local system will continue to have connectivity.

III. ANALYSIS

Local exploitation at an airline call center or travel agency could potentially slow or halt production. Under heavy load, the client will lock up, thereby forcing a reboot. This causes a loss of productivity, particularly in a high-volume call center. Automated ticketing systems running this client can be crashed as well. Since some companies using this software may not regularly monitor such events, they could miss ticketing deadlines, thereby having to pay out of pocket for ticket price changes or penalties

IV. DETECTION

This issue was tested on Sabre Desktop Reservation Software for Windows 4.2, 4.3, and 4.4 on Windows 95 and 98SE, with all the latest patches installed.

V. RECOVERY

Restarting the application should restore normal functionality.

VI. VENDOR FIX/RESPONSE

Sabre responded with the following statement:

"Sabserv will be updated to ignore data it does not understand as part of the next maintenance upgrade to Sabre Desktop Reservation Software for Windows. This will prevent the denial of service condition within the client application when arbitrary data is sent to port 1001."

VII. CVE INFORMATION

The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project has assigned the identification number CAN-2002-1191 to this issue.

VIII. DISCLOSURE TIMELINE

07/26/2002 Issue disclosed to iDEFENSE
08/26/2002 Disclosed to vendor via e-mail to support@sabre.com
08/26/2002 Disclosed to iDEFENSE clients
09/03/2002 Second attempt at e-mail contact
09/15/2002 Call to Sabre technical support rep N2H, referred to customer
support representative
09/20/2002 Fourth attempt at contact (leslie.price@sabre.com)
09/23/2002 Response received from Leslie Price
09/23/2002 Response received from Jeff Harmon (jeff.harmon@sabre.com)
10/10/2002 Coordinated public disclosure

IX. CREDIT

Altomo (adame780@bellsouth.net) is credited with discovering this vulnerability.