what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Adv-20031124.txt

Adv-20031124.txt
Posted Nov 25, 2003
Authored by Evgeny Legerov

S-Quadra Advisory #2003-11-24 - Monit version 4.1 is susceptible to a denial of service via a negative Content-length field and is also vulnerable to a stack overflow when accepting long HTTP requests.

tags | advisory, web, denial of service, overflow
SHA-256 | 640b7a1304c873c6888f2e239b9dd442a50d1a7bfc300a638ff7e843e49e4c1d

Adv-20031124.txt

Change Mirror Download
            S-Quadra Advisory #2003-11-24

Topic: Monit 4.1 HTTP interface Multiple Security Vulnerabilities
Severity: High
Vendor URL: http://www.tildeslash.com/monit/
Advisory URL: http://www.s-quadra.com/advisories/Adv-20031124.txt
Release date: 22 Nov 2003

1. DESCRIPTION

Monit (http://www.tildeslash.com/monit/) is a utility for managing and
monitoring, processes, files, directories and devices on a Unix system.
It conducts automatic maintenance and repair and can execute meaningful
causal actions in error situations.
Monit provides a HTTP(S) interface and you can use a browser to access
the monit server.

There exists several security vulnerabilites in Monit HTTP interface,
which could allow an attacker
in the worst case to gain root access to the system.

2. DETAILS

-- Vulnerability 1: Long http method stack overflow

By supplying an overly large http request method and attacker could
trigger a stack overflow condition which may lead to a remote root
compromise.
Below is a successfull run of 'xonya' Monit <= 4.1 remote root exploit
(PoC):

$./xonya -t 3 -p 2812 192.168.3.12

Selected platform 3 ...
Retaddr is 0xXXXXXXXX, nulladdr is 0xXXXXXXXX ...
Connected to 192.168.3.12:2812
Sending the request ...
Got a remote shell:

Linux 2.4.20 i686 unknown
uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
exit

-- Vulnerability 2: Denial of Service via negative Content-Length field

By supplying a negative value in Content-Length header an attacker could
cause a xmalloc() failure and kill a Monit daemon.
Below is a successfull run of 'donit' Monit <= 4.1 remote Denial of
Service exploit (PoC):

$./donit -p 2812 192.168.3.12

Connecting to 192.168.3.12:2812 ...
Sending the request ...
Done.

$ nc -v 192.168.3.12 2812
lina.s-quadra.com [192.168.3.12] 2812 (?) : Connection refused

3. FIX INFORMATION

S-Quadra alerted Monit development team to this issue on 21th November 2003.
New version of Monit 4.1.1 is available at
http://www.tildeslash.com/monit/dist/monit-4.1.1.tar.gz which fixes the
reported security vulnerabilities.

4. CREDITS

Evgeny Legerov <e.legerov@s-quadra.com> is responsible for discovering
this issue.

5. ABOUT

S-Quadra offers services in computer security, penetration testing and
network assesment,
web application security, source code review and third party product
vulnerability assesment,
forensic support and reverse engineering.

Security is an art and our goal is to bring responsible and high quality
security
service to the IT market, customized to meet the unique needs of each
individual client.

S-Quadra, (pronounced es quadra), is not an acronym.
It's unique, creative and innovative - just like the security services
we bring to our clients.

S-Quadra Advisory #2003-11-24


Login or Register to add favorites

File Archive:

August 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    15 Files
  • 2
    Aug 2nd
    22 Files
  • 3
    Aug 3rd
    0 Files
  • 4
    Aug 4th
    0 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    11 Files
  • 7
    Aug 7th
    43 Files
  • 8
    Aug 8th
    42 Files
  • 9
    Aug 9th
    36 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    27 Files
  • 13
    Aug 13th
    18 Files
  • 14
    Aug 14th
    50 Files
  • 15
    Aug 15th
    33 Files
  • 16
    Aug 16th
    23 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close