full-disclosure - Resources consumption in 602 Lan Suite 2004.0.04.0909

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20041106192257.61df308c.aluigi@autistici.org>
From: aluigi at autistici.org (Luigi Auriemma)
Subject: Resources consumption in 602 Lan Suite 2004.0.04.0909

#######################################################################

                             Luigi Auriemma

Application:  602 Lan Suite
              http://www.software602.com/products/ls/
Versions:     <= 2004.0.04.0909
Platforms:    Windows
Bugs:         A] resources consumption through webmail
              B] sockets consuption through telnet proxy loop
Exploitation: remote
Date:         06 November 2004
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org

#######################################################################

1) Introduction
2) Bugs
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

602 Lan Suite is an all-in-one HTTP, FTP, telnet, SOCKS and RealAudio
proxy server providing also webmail, SMTP and POP services.

#######################################################################

=======
2) Bugs
=======

----------------------------------------
A] resources consumption through webmail
----------------------------------------

The webmail service (/mail) can be used by an attacker to consume CPU
and memory of the remote server.
That happens through the usage of the POST request with a
Content-Length value containing the desired amount of memory to eat and
the subsequent closing of the connection without the need of sending
the specified data.
The duration of the effect of each malformed request depends by the
amount of data specified.

-----------------------------------------------
B] sockets consuption through telnet proxy loop
-----------------------------------------------

The telnet proxy is vulnerable to a loopback attack, practically it
correctly avoids that users request to connect to the IP 127.0.0.1 but
the same filter is not applied to the other network interfaces of the
server, so an attacker can force the server to connect to its same
local IP addresses consuming all its sockets.

#######################################################################

===========
3) The Code
===========

http://aluigi.altervista.org/poc/602res.zip

#######################################################################

======
4) Fix
======

Version 2004.0.04.1104.

#######################################################################

--- 
Luigi Auriemma
http://aluigi.altervista.org