BNBT BitTorrent Tracker Denial of Service Vulnerability
BID:10399
Info
BNBT BitTorrent Tracker Denial of Service Vulnerability
| Bugtraq ID: | 10399 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 22 2004 12:00AM |
| Updated: | May 22 2004 12:00AM |
| Credit: | Discovered by badpack3t. |
| Vulnerable: |
Trevor Hogan BNBT 7.5 Beta Release 2 |
| Not Vulnerable: |
Trevor Hogan BNBT 7.5 Beta Release 3 |
Discussion
BNBT BitTorrent Tracker Denial of Service Vulnerability
BNBT BitTorrent Tracker versions Beta 7.5 release 2 and prior are affected by a flaw related to decoding of HTTP Basic Authentication credentials (util.cpp). If a client transmits to the server the credential string "A==", the server will crash. A check has been introduced in version 73_20040521 that will log exploitation attempts and return prematurely if a request is made with credentials "A==". This may not be enough to eliminate the vulnerability entirely. Version Beta 7.5 Release 3 removes the likely vulnerable code, but may break authentication on Big Endian systems.
BNBT BitTorrent Tracker versions Beta 7.5 release 2 and prior are affected by a flaw related to decoding of HTTP Basic Authentication credentials (util.cpp). If a client transmits to the server the credential string "A==", the server will crash. A check has been introduced in version 73_20040521 that will log exploitation attempts and return prematurely if a request is made with credentials "A==". This may not be enough to eliminate the vulnerability entirely. Version Beta 7.5 Release 3 removes the likely vulnerable code, but may break authentication on Big Endian systems.
Exploit / POC
BNBT BitTorrent Tracker Denial of Service Vulnerability
Exploit code has been made available:
Exploit code has been made available:
Solution / Fix
BNBT BitTorrent Tracker Denial of Service Vulnerability
Solution:
The following upgrade eliminates the vulnerability by removing dependence on the Base64 implementation to calculate a buffer size:
http://bnbt.go-dedicated.com/bnbt75b-3.zip
The maintainer reports that clients on Big Endian servers may no longer be able to authenticate if this version is in use, and that a complete fix is in progress. This alert will be updated as more information becomes available.
Solution:
The following upgrade eliminates the vulnerability by removing dependence on the Base64 implementation to calculate a buffer size:
http://bnbt.go-dedicated.com/bnbt75b-3.zip
The maintainer reports that clients on Big Endian servers may no longer be able to authenticate if this version is in use, and that a complete fix is in progress. This alert will be updated as more information becomes available.
References
BNBT BitTorrent Tracker Denial of Service Vulnerability
References:
References:
- BNBT BitTorrent Tracker Denial Of Service (Security-Protocols.com)
- BNBT Homepage (Trevor Hogan)