full-disclosure - Denial of Service vulnerability in Cewolf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <004301cbd4f5$02d5e780$c103fea9@ml>
Date: Fri, 25 Feb 2011 16:04:37 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>,
	<bugtraq@...urityfocus.com>
Subject: Denial of Service vulnerability in Cewolf

Hello list!

I want to warn you about Denial of Service vulnerability in Cewolf - Chart
Enabling Web Object Framework.

This servlet is using as at individual sites, as in different CMS. Besides
Cewolf itself, also those web applications are vulnerable which are using
it, such as Megapolis.Portal Manager, Inca and other web applications.

-------------------------
Affected products:
-------------------------

Vulnerable are Cewolf 1.1.4 and previous versions, all versions of
Megapolis.Portal Manager, Inca 2.5 and previous versions. And also all web
applications which are using Cewolf.

If developers of Cewolf and Megapolis.Portal Manager ignored this
vulnerability, then developers of Inca answered me and stated that they
would fix it.

----------
Details:
----------

Denial of Service (WASC-10):

http://site/path/cewolf?img=1&width=10000&height=10000

By using large values in parameter width, height or in both parameters it's
possible to consume the whole memory of the server.

At some sites, which are using Inca, there is limitation set on using of
memory by Java-servlets, which slightly protects them from this attack. But
all sites with Megapolis.Portal Manager haven't such limitations.

------------
Timeline:
------------

2010.12.25 - informed developers of Megapolis.Portal Manager.
2010.12.25 - announced at my site.
2010.12.25-26 - informed developers of Cewolf or three different e-mails.
2010.12.26 - informed developers of Inca.
2011.01.31 - received answer from developers of Inca.
2011.02.24 - disclosed at my site.

I mentioned about this vulnerability at my site
(http://websecurity.com.ua/4791/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/