#######################################################################

                             Luigi Auriemma

Application:  ExtremeZ-IP File and Printer Server
              http://www.grouplogic.com/products/extreme/overview.cfm
Versions:     <= 5.1.2x15
Platforms:    Windows
Bugs:         A] crash through the SLP service
              B] crash through the AFP service
              C] limited directory traversal in Zidget/HTTP
Exploitation: remote
Date:         10 Feb 2008
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


EztremeZ-IP is a server for Windows which supports both the Apple
Filing Protocol and Line Printer Daemon for the sharing of files and
printers.


#######################################################################

=======
2) Bugs
=======

--------------------------------
A] crash through the SLP service
--------------------------------

EztremeZ-IP runs by default with a SLP (Service Location Protocol)
daemon enabled.
The service is affected by a problem during the handling of the number
of available URLs, in fact there are no instructions which check if
the incoming packet can really contain the number of URLs specified in
it.
The resulting effect is the crash of the entire server when a big
amount of URLs is used due to the read access to the unallocated memory
after the packet.


--------------------------------
B] crash through the AFP service
--------------------------------

The UAM field in the AFP protocol is used for choosing a guest access
to the remote devices or a specific type of encrypted/hashed password
for the authentication.
An invalid UAM will cause the crash of the server since it doesn't
check if the type of authentication specified by the client is
available or not.


---------------------------------------------
C] limited directory traversal in Zidget/HTTP
---------------------------------------------

By default is enabled also a small webserver which runs on port 8081
and gives access to the Zidget widget and the master list.

This service is affected by a directory traversal vulnerability which
allows an attacker to download any file in the disk which has one of
the following extensions: gif, png, jpg, xml, ico, zip and html.

There are no other ways for bypassing the extension's limitation,
anyway the XML files are often used as format for the configuration
files of various programs.

The directory traversal can be exploited only with the plain backslash
char, hex chars are not supported by the server.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/ezipirla.zip


#######################################################################

======
4) Fix
======


No fix


#######################################################################