TUCoPS :: HP Unsorted T :: c07-2083.htm

Telligent Community Server DoS
DoS against Telligent Community Server
DoS against Telligent Community Server

Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

       Advisory: DoS against Telligent Community Server
    Advisory ID: 4tphi-sa-20070111-communityserver
   Release Date: 01-24-2007
Author: Blake Matheny (bmatheny@mobocracy.net) 

       Software: Community Server <= 2.1

         Impact: Remote DoS


    From Wikipedia, "Community Server is a community collaboration
platform that consists of a core blog, forums, photo gallery, and file
sharing system."
    Several weaknesses have been found in the pingback specification
which has been implemented by Community Server as well as other vendors.
Please see the following advisory for details specific to pingback:
4tphi-sa-20070111-pingback. This advisory describes the results of the
tests run against Community Server.


    Community Server is vulnerable to the attacks described in the
pingback advisory. Because of the license restrictions on this software,
our testing was limited. However, it was found that at a minimum one could
specify an arbitrary sourceURI in the pingback service call. It was also
found that there were no limitations on the Content-Type or size of the
sourceURI. In all tests, the server attempted to fetch large binary data
=66rom all provided URIs. A malicious user could abuse this service by
sending multiple requests where the sourceURI resolved to a large file on
a variety of servers. This can create a DoS scenario by either utilizing
all available bandwidth or by causing the server to allocate all available
threads to service requests. In testing it was found that both scenarios
could be produced. Also see 4tphi-sa-20070111-wordpress for tests run.


    In order to prevent overly large files from being retrieved, a 
reasonable timeout for the request for the sourceURI should be set. Also,
if content is missing a compatible Content-Type (such as text/xml) it
should not be read as it can not be parsed. There are some more
significant design problems, particularly with respect to pingback
authentication. These are described in the pingback advisory and are not
addressed here, as there has been no formal specification modification

Disclosure Timeline:

    01-24-2007 - Released
    01-16-2007 - Ticket closed by Telligent, no response.
    01-15-2007 - Received automated reply for Telligent Support
01-14-2007 - Notified support@telligent.com 


	4tphi-sa-20070111-pingback - Weaknesses in pingback design


This advisory is being provided to you under the RFPolicy documented at
http://www.wiretrip.net/rfp/policy.html. You are encouraged to read this 
policy; however, in the interim, you have approximately 5 days to respond
to this initial email.

Blake Matheny

Content-Type: application/pgp-signature
Content-Disposition: inline

Version: GnuPG v1.4.5 (GNU/Linux)



TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986- AOH