|
|
| |
| SMSGate is "a gateway from Email to SMS and back". A vulnerability in the way SMSGate handles incoming HTTP requests allows remote attackers to cause the server to crash. |
| |
Credit:
The information has been provided by Luigi Auriemma.
The original article can be found at: http://aluigi.altervista.org/adv/smsgheit-adv.txt
|
| |
Vulnerable Systems:
* SMSGate version 1.1n
SMSGate provides both the SMTP/SMS interface and a SSL web administration service running on port 8775 and by default accessible only locally (127.0.0.1).
When a too big HTTP Content-Length value is received, the server tries to allocate the specified amount of memory and when fails shows a debug messagebox in which the admin must choose if aborting the application, debugging it or ignoring the problem (in which case the server will continue to work correctly).
The entire server will be completely unreachable for all the time the Ignore button is not selected, so nobody can send SMS and the remote admin can't manage the server.
Exists also another problem caused by a malformed or non-existent Content-Length value which causes only the showing of an error messagebox (about the impossibility of writing the NULL delimiter at uninitialized pointer at offset 0xcccccccc) since the server will continue to work correctly.
Note the limitation described at the beginning of this section (local IPs only) doesn't affect the exploiting of the vulnerability, so any attacker from any IP address can block the server.
Exploit:
Send the following HTTP request through netcat + stunnel:
POST / HTTP/1.0
Content-Length: -1
|
|
|
|
|
