lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20041106192257.61df308c.aluigi@autistici.org> Date: Sat, 6 Nov 2004 19:22:57 +0000 From: Luigi Auriemma <aluigi@...istici.org> To: bugtraq@...urityfocus.com, bugs@...uritytracker.com, news@...uriteam.com, full-disclosure@...ts.netsys.com, vuln@...unia.com Subject: Resources consumption in 602 Lan Suite 2004.0.04.0909 ####################################################################### Luigi Auriemma Application: 602 Lan Suite http://www.software602.com/products/ls/ Versions: <= 2004.0.04.0909 Platforms: Windows Bugs: A] resources consumption through webmail B] sockets consuption through telnet proxy loop Exploitation: remote Date: 06 November 2004 Author: Luigi Auriemma e-mail: aluigi@...ervista.org web: http://aluigi.altervista.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== 602 Lan Suite is an all-in-one HTTP, FTP, telnet, SOCKS and RealAudio proxy server providing also webmail, SMTP and POP services. ####################################################################### ======= 2) Bugs ======= ---------------------------------------- A] resources consumption through webmail ---------------------------------------- The webmail service (/mail) can be used by an attacker to consume CPU and memory of the remote server. That happens through the usage of the POST request with a Content-Length value containing the desired amount of memory to eat and the subsequent closing of the connection without the need of sending the specified data. The duration of the effect of each malformed request depends by the amount of data specified. ----------------------------------------------- B] sockets consuption through telnet proxy loop ----------------------------------------------- The telnet proxy is vulnerable to a loopback attack, practically it correctly avoids that users request to connect to the IP 127.0.0.1 but the same filter is not applied to the other network interfaces of the server, so an attacker can force the server to connect to its same local IP addresses consuming all its sockets. ####################################################################### =========== 3) The Code =========== http://aluigi.altervista.org/poc/602res.zip ####################################################################### ====== 4) Fix ====== Version 2004.0.04.1104. ####################################################################### --- Luigi Auriemma http://aluigi.altervista.org
Powered by blists - more mailing lists