Radware Linkproof: SSH port DoS

From: Martin Mačok (martin.macok_at_underground.cz)
Date: 06/27/03

  • Next message: Ben Greenberg: "cross-site to root scripting papers"
    Date: Fri, 27 Jun 2003 09:03:53 +0200
    To: vuln-dev@securityfocus.com
    
    

    While doing an external pen-test I have found that Radware Linkproof
    boxes with port 22 open ("SSH-2.0-1.0 Radware SSH") do not allow
    2 simultaneous connections to that port.

    If I open one connection ("ssh whatever@<ip>") and let the daemon wait
    for the password (10 minutes no problem) then I cannot make another
    connection to port 22 on this box even from different source IP
    ("Connection closed by server: Server reached maximum number of
    simultaneous connections") until I explicitely close the first
    connection -- which means that I can easily DoS that service.

    Can somebody with better knowledge of this devices tell me if this is
    the default behaviour or some clueless configuration (except the
    obvious one that this service is wide opened to the Internet)?

    Radware contacted 19.6. 2003. No response yet.

    -- 
             Martin Mačok                 http://underground.cz/
       martin.macok@underground.cz        http://Xtrmntr.org/ORBman/
    

  • Next message: Ben Greenberg: "cross-site to root scripting papers"

    Relevant Pages

    • Re: Correction
      ... Normally to physically disconnect is just a matter of reaching for the ... >> I have an ADSL connection which polls my computer from time to time, ... > disallow each and every port with Windows Firewall? ...
      (microsoft.public.windowsxp.messenger)
    • Re: Using Remote Desktop From an SBS Domain
      ... when you tried to RDP while attached directly to a port on your router? ... Internet to initiate an IP conversation with your computer. ... This situation is different than if you ran your own NAT connection sharing ...
      (microsoft.public.windows.server.sbs)
    • Re: Still cant connect to RWW or OWA remotely
      ... it certainly appears to be something about the SBS configuration. ... Meridian.local Ethernet adapter Local Area Connection: ... Windows SMALL BUSINESS SERVER 2003 Windows IP Configuration ... 192.168.254.254) directly to a port on the router and then ...
      (microsoft.public.windows.server.sbs)
    • Re: Still cant connect to RWW or OWA remotely
      ... it certainly appears to be something about the SBS configuration. ... Meridian.local Ethernet adapter Local Area Connection: ... Windows SMALL BUSINESS SERVER 2003 Windows IP Configuration ... 192.168.254.254) directly to a port on the router and then ...
      (microsoft.public.windows.server.sbs)
    • Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second
      ... When Nmap (or many ... > other applications, such as Telnet) does a connectcall, the OS is ... > supposed to choose a good souce port to bind to for the connection. ... I saw a familiar "Connection reset by peer" every time the random port ...
      (Incidents)