AOH :: HP Unsorted T :: C07-2083.HTM

Telligent Community Server DoS



DoS against Telligent Community Server
DoS against Telligent Community Server




--9dgjiU4MmWPVapMU
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

 
       Advisory: DoS against Telligent Community Server
    Advisory ID: 4tphi-sa-20070111-communityserver
   Release Date: 01-24-2007
Author: Blake Matheny (bmatheny@mobocracy.net) 

       Software: Community Server <= 2.1

         Impact: Remote DoS



Overview:

    From Wikipedia, "Community Server is a community collaboration
platform that consists of a core blog, forums, photo gallery, and file
sharing system."
       
    Several weaknesses have been found in the pingback specification
which has been implemented by Community Server as well as other vendors.
Please see the following advisory for details specific to pingback:
4tphi-sa-20070111-pingback. This advisory describes the results of the
tests run against Community Server.



Details:

    Community Server is vulnerable to the attacks described in the
pingback advisory. Because of the license restrictions on this software,
our testing was limited. However, it was found that at a minimum one could
specify an arbitrary sourceURI in the pingback service call. It was also
found that there were no limitations on the Content-Type or size of the
sourceURI. In all tests, the server attempted to fetch large binary data
=66rom all provided URIs. A malicious user could abuse this service by
sending multiple requests where the sourceURI resolved to a large file on
a variety of servers. This can create a DoS scenario by either utilizing
all available bandwidth or by causing the server to allocate all available
threads to service requests. In testing it was found that both scenarios
could be produced. Also see 4tphi-sa-20070111-wordpress for tests run.



Recommendations:

    In order to prevent overly large files from being retrieved, a 
reasonable timeout for the request for the sourceURI should be set. Also,
if content is missing a compatible Content-Type (such as text/xml) it
should not be read as it can not be parsed. There are some more
significant design problems, particularly with respect to pingback
authentication. These are described in the pingback advisory and are not
addressed here, as there has been no formal specification modification
yet.



Disclosure Timeline:

    01-24-2007 - Released
    01-16-2007 - Ticket closed by Telligent, no response.
    01-15-2007 - Received automated reply for Telligent Support
01-14-2007 - Notified support@telligent.com 



References:

	4tphi-sa-20070111-pingback - Weaknesses in pingback design



LEGAL NOTICES

This advisory is being provided to you under the RFPolicy documented at
http://www.wiretrip.net/rfp/policy.html. You are encouraged to read this 
policy; however, in the interim, you have approximately 5 days to respond
to this initial email.


-- 
Blake Matheny
bmatheny@mobocracy.net 
http://mobocracy.net 

--9dgjiU4MmWPVapMU
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFt7Ek+1RMaZNdlgURAmePAJ9tRUdY9Cf41jF7N0fdBiMiLzqKCgCdHa6i
gGdON67iLaoW3+qDHvZXfPg=7tiH
-----END PGP SIGNATURE-----

--9dgjiU4MmWPVapMU--

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.