Shaun2k2 Palmhttpd Server Remote Denial of Service Vulnerability

Bugtraq ID:	9608
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2004-0264
Remote:	Yes
Local:	No
Published:	Feb 09 2004 12:00AM
Updated:	Jul 12 2009 02:06AM
Credit:	The disclosure of this issue has been credited to the vendor shaun2k2 <[email protected]>.
Vulnerable:	shaun2k2 palmhttpd 3.0 Jim Rees httpd for PalmOS
Not Vulnerable:

Shaun2k2 Palmhttpd Server Remote Denial of Service Vulnerability

It has been reported that Palmhttpd server may be prone to remote denial of service vulnerability, when an attacker attempts to establish multiple connections with the software. This issue occurs because PalmOS can only handle one client connection.

Shaun2k2 Palmhttpd version 3.0 and prior may be prone to this issue. Since the application is an extension of 'httpd for PalmOS' server by Jim Rees, it is assumed that 'httpd for PalmOS' is vulnerable as well, however, this product has been discontinued.

Shaun2k2 Palmhttpd Server Remote Denial of Service Vulnerability

The following proof of concept exploit code has been supplied:

• /data/vulnerabilities/exploits/palmhttpd_dos.c

Shaun2k2 Palmhttpd Server Remote Denial of Service Vulnerability

Solution:
The vendor has released the following patch to address this issue:
---httpd.patch
--- httpd.c 2004-01-14 17:21:41.000000000 +0000
+++ httpd.1.c 2004-02-08 17:13:33.000000000 +0000
@@ -391,8 +391,15 @@
NetLibAddrINToA(AppNetRefnum,
ifinfo.param.interfaceInfo.ipAddr, host);
printf("Listening on %s\n", host);

- while (1) {
- if (f) {
+ /* Here is where the bug manifests: PalmOS can
only take 1 client
+ * connection (according to even the PalmOS
programming documentation),
+ * but this loop accept()s connections forever.
The loop is now commented
+ * out, fixing the bug.
+ * -Shaun2k2
+ */
+
+ /*while (1) {*/
+ if (f) {
xclose(f);
f = NULL;
}
@@ -507,7 +514,7 @@
}

printf("stopped\n");
-}
+/*}*/

char html0[] = "HTTP/1.0 200 OK\nMIME-version:
1.0\nContent-type: %s\n\n";
---

Shaun2k2 Palmhttpd Server Remote Denial of Service Vulnerability

References:

• httpd for PalmOS Homepage (Jim Rees)
  
• palmhttpd Homepage (shaun2k2)
  
• PalmOS httpd accept() queue overflow DoS vulnerability. (=?iso-8859-1?q?Shaun=20Colley?= )