#######################################################################

                             Luigi Auriemma

Application:  SmsGate
              http://www.netwinsite.com/smsgate/
Versions:     <= 1.1n
Platforms:    Windows, Linux and Solaris
Bug:          Denial of Service
Exploitation: remote
Date:         28 Feb 2008
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


SMSGate is a gateway from Email to SMS and back.


#######################################################################

======
2) Bug
======


SMSGate provides both the SMTP/SMS interface and a SSL web
administration service running on port 8775 and by default accessible
only locally (127.0.0.1).

When a too big HTTP Content-Length value is received, the server tries
to allocate the specified amount of memory and when fails shows a debug
messagebox in which the admin must choose if aborting the application,
debugging it or ignoring the problem (in which case the server will
continue to work correctly).

The entire server will be completely unreachable for all the time the
Ignore button is not selected, so nobody can send SMS and the remote
admin can't manage the server.

Exists also another problem caused by a malformed or unexistent
Content-Length value which causes only the showing of an error
messagebox (about the impossibility of writing the NULL delimiter at
uninitialized pointer at offset 0xcccccccc) since the server will
continue to work correctly.

Note the limitation described at the beginning of this section (local
IPs only) doesn't affect the exploiting of the vulnerability, so any
attacker from any IP address can block the server.


#######################################################################

===========
3) The Code
===========


Send the following HTTP request through netcat + stunnel:

POST / HTTP/1.0
Content-Length: -1


#######################################################################

======
4) Fix
======


No fix


#######################################################################