Telligent Community Server源URI pingback服务调用拒绝服务攻击漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1191922 漏洞类型 未知
发布时间 2007-01-29 更新时间 2007-01-29
CVE编号 CVE-2007-0538 CNNVD-ID CNNVD-200701-500
漏洞平台 N/A CVSS评分 5.0
|漏洞来源
https://www.securityfocus.com/bid/86724
https://cxsecurity.com/issue/WLB-2007020016
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200701-500
|漏洞详情
TelligentCommunityServer2.1及之前版本允许远程攻击者借助带有源URI的pingback服务调用,来引起拒绝服务攻击(带宽或thread损耗)。该源URI与(1)一个大的文件(会触发一个没有暂停限制的过长的下载会话)和(2)带有二进制的内容形式的文件相一致(即使没有包含有用的pingback数据,它也会被下载)。
|漏洞EXP
 
       Advisory: DoS against Telligent Community Server
    Advisory ID: 4tphi-sa-20070111-communityserver
   Release Date: 01-24-2007
         Author: Blake Matheny (bmatheny (at) mobocracy (dot) net [email concealed])

Software: Community Server <= 2.1

Impact: Remote DoS

Overview:

From Wikipedia, "Community Server is a community collaboration
platform that consists of a core blog, forums, photo gallery, and file
sharing system."
       
    Several weaknesses have been found in the pingback specification
which has been implemented by Community Server as well as other vendors.
Please see the following advisory for details specific to pingback:
4tphi-sa-20070111-pingback. This advisory describes the results of the
tests run against Community Server.

Details:

Community Server is vulnerable to the attacks described in the
pingback advisory. Because of the license restrictions on this software,
our testing was limited. However, it was found that at a minimum one could
specify an arbitrary sourceURI in the pingback service call. It was also
found that there were no limitations on the Content-Type or size of the
sourceURI. In all tests, the server attempted to fetch large binary data
from all provided URIs. A malicious user could abuse this service by
sending multiple requests where the sourceURI resolved to a large file on
a variety of servers. This can create a DoS scenario by either utilizing
all available bandwidth or by causing the server to allocate all available
threads to service requests. In testing it was found that both scenarios
could be produced. Also see 4tphi-sa-20070111-wordpress for tests run.

Recommendations:

In order to prevent overly large files from being retrieved, a 
reasonable timeout for the request for the sourceURI should be set. Also,
if content is missing a compatible Content-Type (such as text/xml) it
should not be read as it can not be parsed. There are some more
significant design problems, particularly with respect to pingback
authentication. These are described in the pingback advisory and are not
addressed here, as there has been no formal specification modification
yet.

Disclosure Timeline:

01-24-2007 - Released
    01-16-2007 - Ticket closed by Telligent, no response.
    01-15-2007 - Received automated reply for Telligent Support
    01-14-2007 - Notified support (at) telligent (dot) com [email concealed]

References:

4tphi-sa-20070111-pingback - Weaknesses in pingback design

LEGAL NOTICES

This advisory is being provided to you under the RFPolicy documented at
http://www.wiretrip.net/rfp/policy.html. You are encouraged to read this
policy; however, in the interim, you have approximately 5 days to respond
to this initial email.

-- 
Blake Matheny
bmatheny (at) mobocracy (dot) net [email concealed]
http://mobocracy.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFt7Ek+1RMaZNdlgURAmePAJ9tRUdY9Cf41jF7N0fdBiMiLzqKCgCdHa6i
gGdON67iLaoW3+qDHvZXfPg=
=7tiH
-----END PGP SIGNATURE-----
|受影响的产品
Telligent Systems Community Server Forums 2.1
|参考资料

来源:BUGTRAQ
名称:20070124DoSagainstTelligentCommunityServer
链接:http://www.securityfocus.com/archive/1/archive/1/457999/100/0/threaded
来源:BUGTRAQ
名称:20070124WeaknessesinPingbackDesign
链接:http://www.securityfocus.com/archive/1/archive/1/457996/100/0/threaded
来源:OSVDB
名称:33584
链接:http://osvdb.org/33584
来源:OSVDB
名称:33583
链接:http://osvdb.org/33583
来源:SREASON
名称:2211
链接:http://securityreason.com/securityalert/2211