Xitami Denial of Service in Handling malformed request

From: Tri Huynh (trihuynh_at_zeeup.com)
Date: 11/21/03

  • Next message: ronan o kane: "MSN messenger improper file transfer ip-address field parsing" 
    To: <news@securiteam.com>, <bugtraq@securityfocus.com>
Date: Fri, 21 Nov 2003 00:17:16 -0800

    Xitami Denial of Service in Handling malformed request
    =================================================

    PROGRAM: Xitami
    HOMEPAGE: http://www.xitami.com
    VULNERABLE VERSIONS: 2.5 and below

    DESCRIPTION
    =================================================

    LiteServe is a very powerful, full-featured, open-sourced Web server.
    and the flagship of iMatix. This is a great free product.

    DETAILS
    =================================================

    Xitami has a logical error in the way it handles POST request that can be
    used to perform a Denial-of-service attack. An Request like this will
    make the server won't response to any other requests although it is
    still listen to port 80
    POST /forum/index.php HTTP/1.1
    Referer: Sentryunion
    Accept-Encoding: None
    User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
    Content-Length: 10
    (long string here)
    0x0D 0x0A
    (another long string here)
    Xitami is a very good server. However the code to handle parsing the HTTP
    header doesn't have a good logic:

    while(header && *header && *header != '\r')
    {
    header_name = header
    if((header_value=strchr(header_name, ":")) != NULL)
    { ... header++;}
    }
    So if inside the request HTTP header there is no ":" charater. It will make
    the
    while loop runs forever = Denial of Service.

    WORKAROUND
    =================================================
    Use URL filter to filter all the bad request. Vendor doesn't response
    after 2 weeks !

    CREDITS
    =================================================

    Discovered by Tri Huynh from Sentry Union

    DISLAIMER
    =================================================

    The information within this paper may change without notice. Use of
    this information constitutes acceptance for use in an AS IS condition.
    There are NO warranties with regard to this information. In no event
    shall the author be liable for any damages whatsoever arising out of
    or in connection with the use or spread of this information. Any use
    of this information is at the user's own risk.

    FEEDBACK
    =================================================

    Please send suggestions, updates, and comments to: trihuynh@zeeup.com

  • Next message: ronan o kane: "MSN messenger improper file transfer ip-address field parsing"

    Relevant Pages

    • Xitami Denial of Service in Handling malformed request
      ... Xitami Denial of Service in Handling malformed request ... LiteServe is a very powerful, full-featured, open-sourced Web server. ... Xitami has a logical error in the way it handles POST request that can be ... used to perform a Denial-of-service attack. ...
      (Full-Disclosure)
    • [Full-Disclosure] Xitami Denial of Service in Handling malformed request
      ... Xitami Denial of Service in Handling malformed request ... LiteServe is a very powerful, full-featured, open-sourced Web server. ... Xitami has a logical error in the way it handles POST request that can be ... used to perform a Denial-of-service attack. ...
      (Full-Disclosure)
    • [Full-Disclosure] Xitami Denial of Service in Handling malformed request
      ... Xitami Denial of Service in Handling malformed request ... LiteServe is a very powerful, full-featured, open-sourced Web server. ... Xitami has a logical error in the way it handles POST request that can be ... used to perform a Denial-of-service attack. ...
      (Full-Disclosure)
    • [Full-Disclosure] Xitami Denial of Service in Handling malformed request
      ... Xitami Denial of Service in Handling malformed request ... LiteServe is a very powerful, full-featured, open-sourced Web server. ... Xitami has a logical error in the way it handles POST request that can be ... used to perform a Denial-of-service attack. ...
      (Full-Disclosure)
    • [REVS] NTLM HTTP Authentication is Insecure By Design
      ... in front of a web server, and that proxy server shares a single TCP ... These are attacks that make use of non-RFC HTTP requests (HTTP Request ... the authentication is associated with the ...
      (Securiteam)