From: Secunia Security Advisories (sec-advsecunia.com)
Date: Sat Jan 03 2004 - 02:32:40 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
Switch Off HTTP Request Handling Vulnerabilities

SECUNIA ADVISORY ID:
SA10521

VERIFY ADVISORY:
http://www.secunia.com/advisories/10521/

CRITICAL:
Less critical

IMPACT:
DoS, System access

WHERE:
From local network

SOFTWARE:
Switch Off 2.x

DESCRIPTION:
Peter Winter-Smith has reported three vulnerabilities in Switch Off,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.

1) An error in "swnet.dll" may cause the application to enter an
infinite loop when receiving packets with overly large amounts of
data (about 10240 bytes) followed by to CRLFs (Carriage Return, Line
Feed). This can be exploited to cause a DoS by making the application
consume 100% CPU resources.

2) Reportedly, an unspecified error can be exploited to cause a DoS
by sending a normal HTTP GET request without any headers.

Example:
GET / HTTP/1.1

3) A boundary error in "swnet.dll" can be exploited by an
authenticated person to cause a buffer overflow by sending a HTTP
request containing an overly long argument to the "message"
parameter.

Example:
http://[victim]:8000/action.htm?action=SendMsg&message=[long_string]

Successful exploitation may allow execution of arbitrary code but
requires authentication.

The vulnerabilities have been reported in version 2.3 and prior.

SOLUTION:
Restrict access to the service (default port 8000/tcp), allowing only
trusted IP addresses to connect.

PROVIDED AND/OR DISCOVERED BY:
Peter Winter-Smith

ORIGINAL ADVISORY:
http://www.elitehaven.net/switchoff.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://www.secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://www.secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]