[NT] FreeProxy HTTP Proxy Server DoS

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



FreeProxy HTTP Proxy Server DoS
------------------------------------------------------------------------


SUMMARY

<http://www.handcraftedsoftware.org> FreeProxy enables "many users to
share an Internet connection". FreeProxy HTTP proxy server is vulnerable
to denial of service.

DETAILS

Vulnerable Systems:
* FreeProxy version 3.81/1511 (built 10-10-2004 @19:46:16)

The FreeProxy HTTP proxy server hangs when it receives a request is made
for the for the hostname/portnumber combination in use by the server
itself, like so:

$ telnet 10.0.0.1 8080
Trying 10.0.0.1...
Connected to 10.0.0.1.
Escape character is '^]'.
GET / HTTP/1.0
Host: 10.0.0.1:8080

Connection closed by foreign host.

The threads spike as it recursively connects to itself, then fall as each
thread times out waiting on the next, then the controlling threads
themselves appear to hang. The OS will accept the connection (the usual 3
way handshake), but the server will not respond to any requests.

Solution:
Following vendor notification on the 16th January 2007, the vendor
promptly responded with a patched version which fixed this issue.
This was released as build 1626 on the 24th January 2007. Nth Dimension
would recommend upgrading to this version or later.


ADDITIONAL INFORMATION

The information has been provided by <mailto:timb@xxxxxxxxxxxxxxxxxxxx>
Tim Brown.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages