Communigate Pro Web Admin DoS Vulnerability

Bugtraq ID:	860
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Dec 03 1999 12:00AM
Updated:	Dec 03 1999 12:00AM
Credit:	Posted to Bugtraq on December 3, 1999 by Nobuo Miwa <[email protected]>.
Vulnerable:	Stalker Communigate Pro 3.1 - BSDI BSD/OS 4.0 - BSDI BSD/OS 3.0 - BSDI BSD/OS 2.0 - Digital UNIX 4.0 - FreeBSD FreeBSD 3.3 - FreeBSD FreeBSD 3.2 - FreeBSD FreeBSD 3.1 - FreeBSD FreeBSD 3.0 - HP HP-UX 10.0 - IBM AIX 4.3 - IBM AIX 4.2 - IBM AIX 4.1 - Linux kernel 2.3 - Linux kernel 2.2 - Linux kernel 2.1 - Linux kernel 2.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - SCO Unixware 7.1 - SCO Unixware 7.0 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 6.2 - SGI IRIX 6.1 - SGI IRIX 6.0 - Sun Solaris 7.0_x86 - Sun Solaris 7.0
Not Vulnerable:	Stalker Communigate Pro 3.2 b7 Stalker Communigate Pro 3.2 b5

Communigate Pro Web Admin DoS Vulnerability

Communigate Pro 3.1 can be remotely crashed due to a weakness in the remote administration feature. Connecting to port 8010 (the web admin port) and sending a buffer of 70000 characters , then connecting to any other port on the server, will cause the server to crash.

Communigate Pro Web Admin DoS Vulnerability

see discussion

Communigate Pro Web Admin DoS Vulnerability

Solution:
Fixed in the latest beta releases of 3.2, 3.2b5 and 3.2b7, available from:
ftp://ftp.stalker.com/pub/CommuniGatePro/

Communigate Pro Web Admin DoS Vulnerability

References:

• Communigate Pro Homepage (Stalker)