bugtraq - Monkey HTTPd improper input validation vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20091214101855.GA7663@evola>
Date: Mon, 14 Dec 2009 12:18:55 +0200
From: Patroklos Argyroudis <argp@...sus-labs.com>
To: bugtraq@...urityfocus.com
Subject: Monkey HTTPd improper input validation vulnerability

census ID:          census-2009-0004
URL:                http://census-labs.com/news/2009/12/14/monkey-httpd/
CVE ID:             Pending
Affected Products:  Monkey web server versions ≤ 0.9.2.
Class:              Improper Input Validation (CWE-20), Incorrect
                    Calculation (CWE-682)
Remote:             Yes
Discovered by:      Patroklos Argyroudis

We have discovered a remotely exploitable "improper input validation"
vulnerability in the Monkey web server that allows an attacker to
perform denial of service attacks by repeatedly crashing worker threads
that process HTTP requests. 

Details

Monkey (http://www.monkey-project.com/) is a fast, efficient, small and
easy to configure HTTP/1.1 compliant web server. It has been designed to
be scalable with low memory and CPU consumption. More information about
its features can be found at http://www.monkey-project.com/about.

Monkey (up to and including version 0.9.2) employs an insufficient
input validation method for handling HTTP requests with invalid
connection headers. Specifically, the vulnerability is in the
calculation for the end of the request body buffer related to newline
characters in function Request_Find_Variable() in the file
src/request.c.

With a specially crafted request body the pos_init_var integer can take
the value 0x1c (28 in decimal) and the pos_end_var integer can take the
value 0x1a (26 in decimal). Then in the m_copy_string() function, the
calculation for the unsigned integer size in line 428 (file src/utils.c)
leads to a signedness bug and m_copy_string() returns NULL (line 438,
file src/utils.c). This causes Request_Find_Variable() to return NULL
(line 344, file src/request.c) and this to be used in the strstr2() call
at line 345 of file src/request.c.

This vulnerability can allow an attacker to perform denial of service
attacks by repeatedly crashing Monkey worker threads that process HTTP
requests. We have developed a proof-of-concept exploit to demonstrate
the vulnerability:

http://census-labs.com/media/monkeyex.txt

The maintainer of Monkey has been contacted and a new version of the
web server (0.9.3) has been released that addresses this issue:

http://www.monkey-project.com/downloads

All affected parties are advised to upgrade to the latest version
available.

-- 
Patroklos Argyroudis
http://www.census-labs.com/