From peter.grundl@DEFCOM.COM Wed Jan 24 19:29:50 2001 From: "Peter [iso-8859-1] Gründl" X-Sender: prg@mx.defcom.com To: BUGTRAQ@SECURITYFOCUS.COM Date: Tue, 23 Jan 2001 12:57:45 +0100 Subject: [BUGTRAQ] def-2001-06: Easycom/Safecom 10/100 Multiple DoS [The following text is in the "iso-8859-1" character set] [Your display is set for the "US-ASCII" character set] [Some characters may be displayed incorrectly] ====================================================================== Defcom Labs Advisory def-2001-06 Easycom/Safecom 10/100 Multiple DoS Author: Peter Gründl Release Date: 2001-01-23 ====================================================================== ------------------------=[Brief Description]=------------------------- The Easycom/Safecom print server from I-Data International contains multiple vulnerabilites that allow a malicious user to bring down the print server. Execution of arbitrary code is also possible. ------------------------=[Affected Systems]=-------------------------- - Easycom/Safecom, firmware 404.590 - Most likely older firmware revisions as well ----------------------=[Detailed Description]=------------------------ The print server has a web service running on port 80 and on port 631. Both are vulnerable to a long URL request. The long URL results in a buffer overflow on the server. The effect can either be that the unit crashes or execution of arbitrary code on the server. The PrintGuide service on port 5742 will cease to respond, if you send two bursts (80 connects in each burst) of null characters to the port. The FTP service on TCP port 21 is vulnerable to data flooding. The flooding results in the unit being disconnected from the network. The web services on port 80 and port 631 are both vulnerable to long HTTP requests. An infinite HTTP request will result in the unit being disconnected from the network. This is done by eg. issuing a normal GET request and filling A's into an HTTP header field, like "host:". The TCP/IP implementation on the Easycom/Safecom unit is vulnerable to flooding. Sending large burst of "normal" network packets to the unit at eg. 10 mbit will result in the unit being disconnected from the network. ---------------------------=[Workaround]=----------------------------- No vendor supplied workaround known. You could put your unit behind a filtering router, and make sure the ports aren't accessible from the network (except from the managing console, of course). -------------------------=[Vendor Response]=-------------------------- This issue was brought to the vendor's attention on the 30th of November, 2000. Vendor promises to look into it, but has not yet come up with any indication on when a fix would be available. ====================================================================== This release was brought to you by Defcom Labs labs@defcom.com www.defcom.com ======================================================================