goahead.txt

`  
#######################################################################  
  
Luigi Auriemma  
  
Application: Goahead webserver  
http://www.goahead.com/webserver/webserver.htm  
Versions: <= 2.1.8  
Platforms: multiplatform  
Bug: resources consumption  
Risk: medium/high  
Exploitation: remote  
Date: 19 Jan 2004  
Author: Luigi Auriemma  
e-mail: [email protected]  
web: http://aluigi.altervista.org  
  
  
#######################################################################  
  
  
1) Introduction  
2) Bug  
3) The Code  
4) Fix  
  
  
#######################################################################  
  
===============  
1) Introduction  
===============  
  
  
Goahead webserver is an embedded OpenSource server that can be build on  
a lot of systems (CE, Ecos, GNU/Linux, Lynx, MacOS, NW, QNX4, VXWORKS,  
Win32 and others).  
It is supported by a lot of companies that use it for their projects  
and it is also used like "base" for other webservers, furthermore it  
has been developed for be very tiny and to run on embedded systems.  
  
  
#######################################################################  
  
======  
2) Bug  
======  
  
  
The webserver is affected by a bug that lets an attacker to consume all  
its resources.  
Practically the attacker uses the POST method with a specific number  
in the Content-Length parameter (the value that specifies how many  
bytes will be sent to the server) and then he will send an amount of  
data minor than how much specified.  
  
The server will allocate all the data sent by the attacker and then  
will wait the last bytes as specified by Content-Length.  
Then the attacker will break the connection and the server will enter  
in an infinite loop because the socket's error is not well managed.  
  
The following is an example of what the attacker needs to send to the  
server:  
  
------------------  
POST / HTTP/1.0  
Content-Length: 10  
  
123456789  
------------------  
  
So the socket will not be closed by the server, all the memory  
allocated until that moment will not be freed and the CPU will go to  
100% due the infinite loop of the unchecked select() function.  
On some operating systems the webserver will accept no more connections  
after some attacks.  
  
  
#######################################################################  
  
===========  
3) The Code  
===========  
  
  
http://aluigi.altervista.org/poc/webpostmem.zip  
  
  
#######################################################################  
  
======  
4) Fix  
======  
  
  
No official fix.  
  
This bug is known by over one year (October 2002).  
On the official newsgroup of Goahead webserver have been released 2  
patches to fix the problem (9th Nov 2002 and 13th Dec 2003):  
  
news://news.goahead.com/goahead.public.webserver  
  
  
#######################################################################  
  
---   
Luigi Auriemma  
http://aluigi.altervista.org  
`