####################################################################### Luigi Auriemma Application: Goahead webserver http://www.goahead.com/webserver/webserver.htm Versions: <= 2.1.8 Platforms: multiplatform Bug: resources consumption Risk: medium/high Exploitation: remote Date: 19 Jan 2004 Author: Luigi Auriemma e-mail: aluigi@altervista.org web: http://aluigi.altervista.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Goahead webserver is an embedded OpenSource server that can be build on a lot of systems (CE, Ecos, GNU/Linux, Lynx, MacOS, NW, QNX4, VXWORKS, Win32 and others). It is supported by a lot of companies that use it for their projects and it is also used like "base" for other webservers, furthermore it has been developed for be very tiny and to run on embedded systems. ####################################################################### ====== 2) Bug ====== The webserver is affected by a bug that lets an attacker to consume all its resources. Practically the attacker uses the POST method with a specific number in the Content-Length parameter (the value that specifies how many bytes will be sent to the server) and then he will send an amount of data minor than how much specified. The server will allocate all the data sent by the attacker and then will wait the last bytes as specified by Content-Length. Then the attacker will break the connection and the server will enter in an infinite loop because the socket's error is not well managed. The following is an example of what the attacker needs to send to the server: ------------------ POST / HTTP/1.0 Content-Length: 10 123456789 ------------------ So the socket will not be closed by the server, all the memory allocated until that moment will not be freed and the CPU will go to 100% due the infinite loop of the unchecked select() function. On some operating systems the webserver will accept no more connections after some attacks. ####################################################################### =========== 3) The Code =========== http://aluigi.altervista.org/poc/webpostmem.zip ####################################################################### ====== 4) Fix ====== No official fix. This bug is known by over one year (October 2002). On the official newsgroup of Goahead webserver have been released 2 patches to fix the problem (9th Nov 2002 and 13th Dec 2003): news://news.goahead.com/goahead.public.webserver ####################################################################### --- Luigi Auriemma http://aluigi.altervista.org