[Full-disclosure] [Amsn-devel] aMSN <= 0.96 remote DoS vulnerability

[Ismail Dönmez]

On Sunday 22 April 2007 18:51:39 Levent Kayan wrote:
[...]
> 31337 is just an example port! aMSN is binding an ephermal port after
> you've started it. Just do a netstat -an and look for ephermal ports. If
> you get the aMSN port you can connect to it and sending some characters and
> you'll get replies by aMSN.
> If you send an '{' or '}' character to that amsn port, you'll notice
> that aMSN is reporting an error message (amsn window).
> But if you going to send more than one character of '}' or '{'
> it will be killed. Yes, the whole client!
>
> To "Ismail Soenmez": 

Learn to spell my name correctly first.

> What about "DDoS"? Sending characters to that port in 
> an "infinite" loop is a DDoS for you?

If you read the PoC you wrote you'll see that you forgot to increment the 
value of i in the loop. So yes you are sending packages in an infinite loop. 
Thats DoS, never mind the double D I stuck up there.

-- 
Life is a game, and if you aren't in it to win,
what the heck are you still doing here?

-- Linus Torvalds (talking about open source development)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part.
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070422/7531c55a/attachment.bin