BID:16868

NuFW Remote TLS Connection Handling Denial of Service Vulnerability

Info

NuFW Remote TLS Connection Handling Denial of Service Vulnerability

Bugtraq ID:	16868
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Feb 28 2006 12:00AM
Updated:	Mar 03 2006 06:11AM
Credit:	The vendor disclosed this issue.
Vulnerable:	NuFW NuFW 1.0.20 NuFW NuFW 1.0.19 NuFW NuFW 1.0.18 NuFW NuFW 1.0.17 NuFW NuFW 1.0.16 NuFW NuFW 1.0.15 NuFW NuFW 1.0.14 NuFW NuFW 1.0.13 NuFW NuFW 1.0.12 NuFW NuFW 1.0.11

Not Vulnerable:	NuFW NuFW 1.0.21

Discussion

NuFW Remote TLS Connection Handling Denial of Service Vulnerability

NuFW is susceptible to a remote denial-of-service vulnerability. This issue is due to the application's failure to properly handle excessive authentication requests.

This issue results in the 'nuauth' module failing to respond to new authentication requests, denying service to further users.

NuFW versions prior to 1.0.21 are affected by this issue.

Exploit / POC

NuFW Remote TLS Connection Handling Denial of Service Vulnerability

An exploit application is not required to trigger this issue. Attackers likely utilize already-existing network utilities to exploit this issue.

Solution / Fix

NuFW Remote TLS Connection Handling Denial of Service Vulnerability

Solution:
The vendor has released version 1.0.21 to address this issue.

NuFW NuFW 1.0.11