ElectroSoft ElectroComm Denial of Service Vulnerability

Bugtraq ID:	2706
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	May 07 2001 12:00AM
Updated:	May 07 2001 12:00AM
Credit:	Reported to bugtraq by nemesystm <[email protected]> on May 7, 2001.
Vulnerable:	ElectroSoft ElectroComm 2.0 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0 ElectroSoft ElectroComm 1.0
Not Vulnerable:

ElectroSoft ElectroComm Denial of Service Vulnerability

ElectroComm is a telnet-comm port server for Windows 9x/NT, allowing users to connect a PC's comm port to a TCP/IP network and login remotely using Telnet.

An attacker can execute a denial of service attack on ElectroComm by submitting two groups of approximately 160,000 characters to the target's telnet port.

This increases CPU utilization to 100%, then crashes the service, which requires a restart.

ElectroSoft ElectroComm Denial of Service Vulnerability

Courtesy nemesystm <[email protected]>

• /data/vulnerabilities/exploits/electro.zip

ElectroSoft ElectroComm Denial of Service Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ElectroSoft ElectroComm Denial of Service Vulnerability

References:

• ElectroComm homepage (ElectroSoft)