def-2001-12: Hursley Software Laboratories Consumer Transaction Framework DoS

Type securityvulns
Reporter Securityvulns
Modified 2001-03-21T00:00:00


====================================================================== Defcom Labs Advisory def-2001-12

Hursley Software Laboratories Consumer Transaction Framework DoS

Author: Peter Grьndl <> Release Date: 2001-03-20 ====================================================================== ------------------------=[Brief Description]=------------------------- The HSLCTF HTTP object contains a flaw that could allow a malicious attacker to crash the web object and interconnected objects (eg. SMTP)

------------------------=[Affected Systems]=-------------------------- - HSLCTF 1.0 for AIX

----------------------=[Detailed Description]=------------------------ A never-ending HTTP request will crash the HTTP service, and can also bring down the internal mail system. The request looks like this:

GET / HTTP/1.0\r\\r\nreferrer: aaaaaaa..aaaaaaaaaaaa

This means a script that will continue to fire in "a"'s in the socket, until it exhausts the server.

This vulnerability is closely coupled with def-2001-11, as the method of triggering the crash in HSLCTF is the same is the one in Websweeper:

---------------------------=[Workaround]=----------------------------- The following workaround example has been supplied by IBM Hursley Software Laboratories, see "Vendor Response":

import; import;

public class LimitHttpTcpipAdapter extends CTFTcpipHttpAdapter { protected String ReadLine( ) throws Exception { int intChar; int i = 0; StringBuffer Result = new StringBuffer( 1024 ); / read Header from input stream / while ( true ) / repeat until "newline"/ { intChar =; / read a character / switch ( intChar ) / what character / { case -1: / ... no character / i = i + 1; / error count / if ( i > 3 ) / more than threshold ? / throw new EOFException(); / ... yes, EOF / else / ... no / Thread.sleep( 10 ); / wait a bit / break; case 10: / line feed / BytesRead = BytesRead + Result.length(); / data received so far / return( Result.toString() ); / all done / case 13: / carridge return / BytesRead = BytesRead + 1; / data received so far / break; default: / real data / i = 0; / timeout count reset / Result.append( (char) intChar ); / append to string / if ( Result.length( ) > 1024 ) throw new IOException( "missing cr-lf delimiter" ); } / switch / } / while / } }

-------------------------=[Vendor Response]=-------------------------- This issue was brought to the vendor's attention on the 9th of November, 2000 and a workaround was received by the vendor on the 20th of March 2001. The Danish Vendor replied (translated to English):

"Support on the CTF toolkit stopped at the end of 2000, but customers can protect themselves against http header overflow, see workaround from IBM hursley"

Hursley Software Laboratories replied:

"The customer can put in what ever extra checks or controls they wish. In the following example I have shown how a check can be made for header records not exceeding 1024 characters in length by creating a descendent of the CTFTcpipHttpAdapter this descendent adapter would then be used in place of the CTFTcpipHttpAdapter in the start up information for the webserver i.e.

In the web server ini file (or equivalent AddAdapter statement in the server start up code) [Adapter] TCPIPHTTP=LimitHttpTcpipAdapter

Only the customer will know what limits they want to impose and what they want to do if the limits are exceeded, since it depends on the sending application, any additional information proxy's or firewalls may add etc..."

====================================================================== This release was brought to you by Defcom Labs