#######################################################################

                             Luigi Auriemma

Application:  Goahead webserver
              http://www.goahead.com/webserver/webserver.htm
Versions:     <= 2.1.8
Platforms:    multiplatform
Bug:          resources consumption
Risk:         medium/high
Exploitation: remote
Date:         19 Jan 2004
Author:       Luigi Auriemma
              e-mail: aluigi@altervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Goahead webserver is an embedded OpenSource server that can be build on
a lot of systems (CE, Ecos, GNU/Linux, Lynx, MacOS, NW, QNX4, VXWORKS,
Win32 and others).
It is supported by a lot of companies that use it for their projects
and it is also used like "base" for other webservers, furthermore it
has been developed for be very tiny and to run on embedded systems.


#######################################################################

======
2) Bug
======


The webserver is affected by a bug that lets an attacker to consume all
its resources.
Practically the attacker uses the POST method with a specific number
in the Content-Length parameter (the value that specifies how many
bytes will be sent to the server) and then he will send an amount of
data minor than how much specified.

The server will allocate all the data sent by the attacker and then
will wait the last bytes as specified by Content-Length.
Then the attacker will break the connection and the server will enter
in an infinite loop because the socket's error is not well managed.

The following is an example of what the attacker needs to send to the
server:

------------------
POST / HTTP/1.0
Content-Length: 10

123456789
------------------

So the socket will not be closed by the server, all the memory
allocated until that moment will not be freed and the CPU will go to
100% due the infinite loop of the unchecked select() function.
On some operating systems the webserver will accept no more connections
after some attacks.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/webpostmem.zip


#######################################################################

======
4) Fix
======


No official fix.

This bug is known by over one year (October 2002).
On the official newsgroup of Goahead webserver have been released 2
patches to fix the problem (9th Nov 2002 and 13th Dec 2003):

   news://news.goahead.com/goahead.public.webserver


#######################################################################

--- 
Luigi Auriemma
http://aluigi.altervista.org