####################################################################### Luigi Auriemma Application: SmsGate http://www.netwinsite.com/smsgate/ Versions: <= 1.1n Platforms: Windows, Linux and Solaris Bug: Denial of Service Exploitation: remote Date: 28 Feb 2008 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== SMSGate is a gateway from Email to SMS and back. ####################################################################### ====== 2) Bug ====== SMSGate provides both the SMTP/SMS interface and a SSL web administration service running on port 8775 and by default accessible only locally (127.0.0.1). When a too big HTTP Content-Length value is received, the server tries to allocate the specified amount of memory and when fails shows a debug messagebox in which the admin must choose if aborting the application, debugging it or ignoring the problem (in which case the server will continue to work correctly). The entire server will be completely unreachable for all the time the Ignore button is not selected, so nobody can send SMS and the remote admin can't manage the server. Exists also another problem caused by a malformed or unexistent Content-Length value which causes only the showing of an error messagebox (about the impossibility of writing the NULL delimiter at uninitialized pointer at offset 0xcccccccc) since the server will continue to work correctly. Note the limitation described at the beginning of this section (local IPs only) doesn't affect the exploiting of the vulnerability, so any attacker from any IP address can block the server. ####################################################################### =========== 3) The Code =========== Send the following HTTP request through netcat + stunnel: POST / HTTP/1.0 Content-Length: -1 ####################################################################### ====== 4) Fix ====== No fix #######################################################################