[17643] in bugtraq
Rideway PN Telnet DoS
daemon@ATHENA.MIT.EDU (SNS Research)
Mon Nov 13 20:41:30 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <3A1082E8.6D6FFEE9@greyhack.com>
Date: Tue, 14 Nov 2000 01:10:17 +0100
Reply-To: SNS Research <vuln-dev@GREYHACK.COM>
From: SNS Research <vuln-dev@GREYHACK.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
Strumpf Noir Society Advisories
! Public release !
<--#
-= Rideway PN Telnet DoS =-
Release date: Tuesday, November 14, 2000
Introduction:
RideWay PN is a proxy server application that enables multiple users to
share resources and files and that allows users to access the Internet
simultaneously through one shared Internet connection.
Rideway PN can be found at vendor ITServ Inc's website,
http://www.itserv.com
Problem:
When Rideway PN is running with the telnet proxy service enabled,
sending several random streams of data to this port (default=23) can
cause the server to deny access to all services.
Demonstration:
Below is the response in the RPN logs after sending 5 requests
containing basically you're home-grown 200 byte buffer.
11/06/00 18:12:57 Error(11001): WSAHOST_NOT_FOUND
(gethostbyname)(NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN)
(DnsNameToIP)
11/06/00 18:12:57 Connect(1): need secure dest
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN/06/00
18:12:57 Connect(1): need secure dest
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN/06/00
18:13:01 Error(11001): WSAHOST_NOT_FOUND
(gethostbyname)(NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN)
(DnsNameToIP)
11/06/00 18:13:01 Connect(1): need secure dest
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN/06/00
18:13:01 Connect(1): need secure dest
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN/06/00
18:13:05 Error(11001): WSAHOST_NOT_FOUND
(gethostbyname)(NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN)
(DnsNameToIP)
11/06/00 18:13:05 Connect(1): need secure dest
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN/06/00
18:13:05 Connect(1): need secure dest
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN/06/00
18:36:20 Debug: ============ Initialize RideWay PN Server (161)
============
After this you'll find the services on the system are frozen untill the
server is restarted.
(..)
This problem was tested against Rideway PN v6.22 running on
Win95/98/NT/2K. Vendor was notified twice, but has yet to respond.
yadayadayada
SNS Research is rfpolicy (http://www.wiretrip.net/rfp/policy.html)
compliant, all information is provided on AS IS basis.
EOF, but Strumpf Noir Society will return!
