Onderwerp: Positive Technologies Security Advisory 2003-0307: DoS-attack in Kerio WinRoute Firewall

Positive Technologies Security Advisory
http://www.ptsecurity.com


Title: DoS-attack in Kerio WinRoute Firewall
Date: March, 07 2003
Severity: High
Application: Kerio WinRoute Firewall 5.0.1
Platform: Windows 95/98/ME/NT/2000/XP
Vendor Status: Notified, patched in version 5.0.2



I. DESCRIPTION

---------------

Denial of Service condition exists in Kerio WinRoute Firewall's Web
administration interface which hand service with 100% CPU utilization.


Positive Technologies reports that single simple HTTP request to Kerio
Winroute Firewall Web administration interface (TCP/4080)


GET / HTTP/1.0
Authorization: Basic XXX


instead of correct one:


GET / HTTP/1.0
Host: server
Authorization: Basic XXX


causes 100% CPU utilization of attacked computer.


II. IMPACT

---------------

Remote user can launch denial of service attack against web interface
(port TCP/4080). Single request causes 100% CPU utilization. As a result
more than 50% of future connection requests may be lost disturbing
normal functionality of the networking services.


III. SOLUTION

---------------

Block TCP/4080 access or upgrade to Kerio WinRoute Firewall 5.0.2.


IV. VENDOR FIX/RESPONSE

---------------

Vendor was notified on 10.03.2003.


V. CREDIT

---------------

Positive Technologies is information security company especially focused on
protection of corporate networks from external attacks. The main trend of
PT’s activity is computer networks security audit and service. PT offers
wide range of services in the filed of information security: from network
architecture development or optimization to consulting and custom software
source-code examination.

--6c2NcOVqGQ03X4Wi
Content-Type: text/plain; charset=windows-1251
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Mar 31, 2003 at 10:00:26AM +0400, Dmitry Maksimov wrote:
[snip]
> Positive Technologies reports that single simple HTTP request to Kerio
> Winroute Firewall Web administration interface (TCP/4080)
>=20
> GET / HTTP/1.0
> Authorization: Basic XXX
> =20
> instead of correct one:
>=20
> GET / HTTP/1.0
> Host: server
> Authorization: Basic XXX
>=20
>=20
> causes 100% CPU utilization of attacked computer.

Hmm. Correct me if I'm wrong, but IMHO version 1.0 of the HTTP protocol
does *not* require a Host header in the request. The Host header is a
requirement in HTTP/1.1 for virtual hosting, isn't it? Thus, an
HTTP/1.0 request without a Host header is perfectly valid, and expected.
This would mean that this application breaks not only on invalid
requests, but also on legitimate ones.

G'luck,
Peter

--=20
Peter Pentchev roam@ringlet.net roam@sbnd.net roam@FreeBSD.org
PGP key: http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553
I am jealous of the first word in this sentence.

--6c2NcOVqGQ03X4Wi
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (FreeBSD)

iD8DBQE+iUSm7Ri2jRYZRVMRArQ3AJwMnORIIpnY2RlM7TBbt6 VyrHCnCwCfYjmo
o+YzkxQTY5GCohip+8MSbyA=
=wnY5
-----END PGP SIGNATURE-----

--6c2NcOVqGQ03X4Wi--