mailing list archives
Potential DOS attack with Web-CyrAdm.
From: Casper Aleva <tonus () dsinet org>
Date: Mon, 30 Dec 2002 02:30:18 +0100
-----BEGIN PGP SIGNED MESSAGE-----
DSINet Security Advisory DSINET-SA-02-01
Potential DOS attack with Web-CyrAdm
Credits: Remko Lodder ( remko () dsinet org - http://www.dsinet.org/ )
Vendor: Luc de Louw ( luc at delouw.ch - http://www.web-cyradm.org/ )
Affected versions: Version 0.5.2 and older.
Non-affected versions: CVS snapshot as of 12-12-2002.
- - Synopsis
The Package Web-CyrAdm, used for administring Cyrus IMAP deamons,
has a potential DoS attack.
- - Problem description
When the IMAP daemon is not running a DoS situation can
occur when someone logs into the web-cyradm package.
The problem rises when someone selects a domain and wants to administer
his / her user accounts.
At this point there is no check that looks if IMAP is running or not.
Without this check the program goes into a infinite loop complaining
about valid file handlers.
- - Impact
This problem can increase the total datastream to 10mb+ in a matter of
This also causes the host to stop responding to other requests, including
those coming from localhost.
In some cases it takes down the entire system as a result of heavy CPU
Remko notified luc at delouw.ch immediatly by creating a bugzilla bug
thread. Luc responded quickly and updated the CVS right away.
- - Solution
The solution is a check which looks wether the IMAP daemon runs or not.
$cyr_conn = new cyradm;
$error=$cyr_conn -> imap_login();
die ("Error $error");
This is the given solution and as far as the vendor could see it worked.
- - Affected files:
- - Actions to be taken by users
Users using Web-CyrAdm are advised to upgrade to the latest version which
can be found in the CVS.
- - Credits
Thanks go out to:
Remko Lodder (remko () dsinet org) for tracing this bug,
Luc de Louw (luc at delouw.ch) for patching it.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (FreeBSD)
-----END PGP SIGNATURE-----
Full-Disclosure - We believe in it.
- Potential DOS attack with Web-CyrAdm. Casper Aleva (Dec 30)