Foundstone, Inc.
                        http://www.foundstone.com
                      "Securing the Dot Com World"

                           Security Advisory

                           AnalogX Proxy DoS

----------------------------------------------------------------------
FS Advisory ID:         FS-072500-7-ANA.txt

Release Date:           July 25, 2000

Product:                Proxy

Vendor:                 AnalogX (http://www.analogx.com)

Vendor Advisory:        New patched version 4.05 available

Type:                   Denial of service through multiple buffer
                        overflows.

Severity:               Low

Author:                 Robin Keir (robin.keir@foundstone.com)
                        Stuart McClure (stuart.mcclure@foundstone.com)
                        Foundstone, Inc. (http://www.foundstone.com)

Operating Systems:      All Windows operating systems supported by
                        Proxy

Vulnerable versions:    Proxy 4.04 (and possibly previous versions)

Foundstone Advisory:    http://www.foundstone.com/advisories.htm
----------------------------------------------------------------------

Description

        AnalogX Proxy is a simple but effective proxy server that has
        the ability to proxy requests for the following services:
        HTTP, HTTPS, SOCKS4, SOCKS4a, SOCKS5, NNTP, POP3, SMTP, FTP.

        Using commands of an appropriate length, many of the services
        exhibit unchecked buffers causing the proxy server to crash
        with an invalid page fault thus creating a denial of service.
        Normally this would only be a concern for users on the LAN
        side of the proxy, but by default Proxy is configured to bind
        to all interfaces on the host and so this would be exploitable
        remotely from over the Internet.

Details

        Standard commands of an appropriate size issued to the FTP,
        SMTP, POP3 and SOCKS services cause page faults bringing the
        entire program to a halt.

Proof of concept

        Sending an FTP "USER" command containing approximately 370 or
        more characters to the proxy server FTP TCP port 21 will crash
        it.

        Example #1: nc 192.168.1.2 21 < ftp.txt

        Where ftp.txt contains:
        "USER [long string of ~370 chars]@isp.com"

        Sending an SMTP "HELO" command containing approximately 370 or
        more characters to the proxy server SMTP TCP port 25 will
        crash it.

        Example #2: nc 192.168.1.2 21 < smtp.txt

        Where smtp.txt contains:
        "HELO [long string of ~370 chars]@isp.com"

        Sending a POP3 "USER" command containing approximately 370 or
        more characters to the proxy server POP3 TCP port 110 will
        crash it.

        Example #3: nc 192.168.1.2 21 < pop3.txt

        Where pop3.txt contains:
        "USER [long string of ~370 chars]@isp.com"

        Sending a SOCKS4 "CONNECT" request with an overly large user
        ID field of roughly 1800 characters or more to the proxy
        server SOCKS TCP port 1080 will crash it.

        Example #4: nc 192.168.1.2 1080 < socks.dat

        Where socks.dat contains binary data with a user ID field of
        approx. 1800 bytes.

Solution

        Download Proxy 4.05 from

        http://www.analogx.com/contents/download/network/proxy.htm

        Prelimiary tests of the fix by Foundstone have confirmed the
        problem is corrected.

Credits

        We would like to thank AnalogX for their prompt reaction to
        this problem and their co-operation in heightening security
        awareness in the security community.

Disclaimer

        THE INFORMATION CONTAINED IN THIS ADVISORY IS THE COPYRIGHT
        (C) 2000 OF FOUNDSTONE, INC. AND BELIEVED TO BE ACCURATE AT
        THE TIME OF PRINTING, BUT NO REPRESENTATION OR WARRANTY IS
        GIVEN, EXPRESS OR IMPLIED, AS TO ITS ACCURACY OR COMPLETENESS.
        NEITHER THE AUTHOR NOR THE PUBLISHER ACCEPTS ANY LIABILITY
        WHATSOEVER FOR ANY DIRECT, INDIRECT OR CONQUENTIAL LOSS OR
        DAMAGE ARISING IN ANY WAY FROM ANY USE OF, OR RELIANCE PLACED
        ON, THIS INFORMATION FOR ANY PURPOSE. THIS ADVISORY MAY BE
        REDISTRIBUTED PROVIDED THAT NO FEE IS ASSIGNED AND THAT THE
        ADVISORY IS NOT MODIFIED IN ANY WAY.