SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Pigeon Server Vendors:   Tech-Noel Inc.
Pigeon Server Input Validation Error in Login Parameter Lets Remote Users Freeze the Server
SecurityTracker Alert ID:  1011333
SecurityTracker URL:  http://securitytracker.com/id/1011333
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 17 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 3.02.0143 and prior versions
Description:   Luigi Auriemma reported a vulnerability in Pigeon Server. A remote user can cause the server to freeze.

It is reported that a remote user can send a login parameter value longer than 8180 characters to port 3103 to cause the target Pigeon server to enter an infinite loop and stop processing messages.

Some demonstration exploit code is available at:

http://aluigi.altervista.org/poc/pigeonx.zip

Impact:   A remote user can cause the target service to freeze.
Solution:   The vendor has released a fixed version (3.03.146), available at:

ftp://ftp.tech-noel.com/PigeonServerUpd.exe

Vendor URL:  www.tech-noel.com/PigeonServer.html (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Freeze in Pigeon Server 3.02.0143



#######################################################################

                             Luigi Auriemma

Application:  Pigeon Server
              http://www.tech-noel.com
Versions:     <= 3.02.0143
Platforms:    Windows
Bug:          freeze
Risk:         medium
Exploitation: remote, versus server
Date:         16 September 2004
Author:       Luigi Auriemma
              e-mail: aluigi@altervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Pigeon is a communication system for LANs and uses a clients-server
architecture.


#######################################################################

======
2) Bug
======


A login field longer than 8180 chars sent to the port 3103 causes the
immediate freeze of the Pigeon server that enters in an infinite loop,
so CPU raises at 100% and is impossible to login and to send/receive
messages.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/pigeonx.zip


#######################################################################

======
4) Fix
======


Version 3.03.146:

  ftp://ftp.tech-noel.com/PigeonServerUpd.exe


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC