bugtraq - DoS against Telligent Community Server

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070124191900.GC16667@beth>
Date: Wed, 24 Jan 2007 11:19:00 -0800
From: bmatheny@...ocracy.net
To: bugtraq@...urityfocus.com
Cc: vuln@...unia.com
Subject: DoS against Telligent Community Server

 
       Advisory: DoS against Telligent Community Server
    Advisory ID: 4tphi-sa-20070111-communityserver
   Release Date: 01-24-2007
         Author: Blake Matheny (bmatheny@...ocracy.net)

       Software: Community Server <= 2.1

         Impact: Remote DoS



Overview:

    From Wikipedia, "Community Server is a community collaboration
platform that consists of a core blog, forums, photo gallery, and file
sharing system."
       
    Several weaknesses have been found in the pingback specification
which has been implemented by Community Server as well as other vendors.
Please see the following advisory for details specific to pingback:
4tphi-sa-20070111-pingback. This advisory describes the results of the
tests run against Community Server.



Details:

    Community Server is vulnerable to the attacks described in the
pingback advisory. Because of the license restrictions on this software,
our testing was limited. However, it was found that at a minimum one could
specify an arbitrary sourceURI in the pingback service call. It was also
found that there were no limitations on the Content-Type or size of the
sourceURI. In all tests, the server attempted to fetch large binary data
from all provided URIs. A malicious user could abuse this service by
sending multiple requests where the sourceURI resolved to a large file on
a variety of servers. This can create a DoS scenario by either utilizing
all available bandwidth or by causing the server to allocate all available
threads to service requests. In testing it was found that both scenarios
could be produced. Also see 4tphi-sa-20070111-wordpress for tests run.



Recommendations:

    In order to prevent overly large files from being retrieved, a 
reasonable timeout for the request for the sourceURI should be set. Also,
if content is missing a compatible Content-Type (such as text/xml) it
should not be read as it can not be parsed. There are some more
significant design problems, particularly with respect to pingback
authentication. These are described in the pingback advisory and are not
addressed here, as there has been no formal specification modification
yet.



Disclosure Timeline:

    01-24-2007 - Released
    01-16-2007 - Ticket closed by Telligent, no response.
    01-15-2007 - Received automated reply for Telligent Support
    01-14-2007 - Notified support@...ligent.com



References:

	4tphi-sa-20070111-pingback - Weaknesses in pingback design



LEGAL NOTICES

This advisory is being provided to you under the RFPolicy documented at
http://www.wiretrip.net/rfp/policy.html. You are encouraged to read this
policy; however, in the interim, you have approximately 5 days to respond
to this initial email.


-- 
Blake Matheny
bmatheny@...ocracy.net
http://mobocracy.net

Content of type "application/pgp-signature" skipped