The htcpcp from madmaze

Null pointer dereference leading to crash of the server (splitVarVal)

HTCPCP server incorrectly handles incoming network messages leading to a NULL pointer dereference, resulting in crash of the server.

Proposed CVSS 3.0 score:

7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Error message WITHOUT Address Sanitizer:

Welcome to the potLogic CoffeeTr0n!
    Ready to brew.. there are 5 Pots available
Created thread 0
Thread 0

Request:
D������g�rd�
Segmentation fault

Error message WITH Address Sanitizer:

./matrixssl-ASAN/apps/dtls/dtlsServer -p 44444
DTLS server running on port 44444
sslBuf = 0x61b00001e380 recvfromBuf = 0x61b00001f180 recvLen = 67
sslBuf = 0x61b00001ea80 recvfromBuf = 0x61b00001f180 recvLen = 1047
=================================================================
Created thread 0
Thread 0

Request:
D������g�rd�
ASAN:SIGSEGV
=================================================================
    ==21766==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f2af2a2f746 bp 0x7f2aefbfbd10 sp 0x7f2aefbfb498 T1)
        #0 0x7f2af2a2f745 in strlen (/lib/x86_64-linux-gnu/libc.so.6+0x8b745)
        #1 0x7f2af2ffb1a5 in __interceptor_strlen (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x701a5)
        #2 0x40347b in splitVarVal (htcpcp_server_ASAN+0x40347b)
        #3 0x40392b in CoffeeRequestHandler (htcpcp_server_ASAN+0x40392b)
        #4 0x403e47 in thread (htcpcp_server_ASAN+0x403e47)
        #5 0x7f2af2d756b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
        #6 0x7f2af2aab41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV ??:0 strlen
    Thread T1 created by T0 here:
        #0 0x7f2af2fc1253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
        #1 0x404b09 in main (htcpcp_server_ASAN+0x404b09)
        #2 0x7f2af29c482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

    ==21766==ABORTING

Reproduction:

Download and compile HTCPCP server.
Run HTCPCP server:
./htcpcp_server 44444

(using defork from Preeny package: https://github.com/zardus/preeny)
LD_PRELOAD=~/tools/preeny/defork.so ./htcpcp_server 44444

Unzip and send attached crafted message e.g. using netcat:
netcat $IP 44444 < payload_madmaze-htcpcp_000.raw
where $IP is IP of test server

payload_madmaze-htcpcp_000.raw.zip

Accept-Additions Header non-compliant with RFC2324

The stored responses with an Accept-Additions header incorrectly delimits additions with semicolons, when semicolons [";"] should be used per addition to denote additional "params" (see relevant section of RFC2324) or "accept-params" (see relevant section of RFC2616). While RFC2324 doesn't explicitly denote a separation character, a comma [","] is standard use for HTTP header ranges.

Wrong Content-Type for BREW

Your implementation of HTCPCP uses an Content-Type of "message/coffeepot" for BREW, even thought RFC 2324 clearly states that it should be "application/coffee-pot-command".

Please fix this ASAP.

madmaze / htcpcp Goto Github PK

htcpcp's People

Contributors

Stargazers

Watchers

Forkers

htcpcp's Issues

The RFC2324 has been updated by RFC7168

Null pointer dereference leading to crash of the server (splitVarVal)

Error message WITHOUT Address Sanitizer:

Error message WITH Address Sanitizer:

Accept-Additions Header non-compliant with RFC2324

Wrong Content-Type for BREW

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent