Allegro RomPager 4.34 Cookie resource management

Summaryinfo

A vulnerability was found in Allegro RomPager 4.34. It has been declared as critical. This impacts an unknown function of the component Cookie Handler. Such manipulation leads to resource management. This vulnerability is referenced as CVE-2015-9222. It is possible to launch the attack remotely. Furthermore, an exploit is available. Restrictive firewalling should be applied.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Allegro RomPager 4.34. Affected by this issue is some unknown processing of the component Cookie Handler. The manipulation with an unknown input leads to a resource management vulnerability. Using CWE to declare the problem leads to CWE-399. Impacted is confidentiality, integrity, and availability.

The weakness was published 04/28/2016 as File 136831 as confirmed exploit (Packetstorm). The advisory is shared for download at packetstormsecurity.com. This vulnerability is handled as CVE-2015-9222 since 08/16/2017. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available.

A public exploit has been developed in Python and been published immediately after the advisory. The exploit is available at packetstormsecurity.com. It is declared as functional. As 0-day the estimated underground price was around $5k-$25k. The code used by the exploit is:

def bruteforce():
  for i in range(107364000,107380000):
    for j in range(0,40):
      print "testing " + str(i) + " , " + str(j)
      result = request(i,j,"\x00")[0]
      if result <= 302:
        print "YEAHHH!!!!"
        print str(i) + " , " + str(j) + " is the answer!"
        return
      elif result == 1000:
        time.sleep(60)

Addressing this vulnerability is possible by firewalling .

The vulnerability is also documented in the databases at X-Force (112798), Exploit-DB (39739) and SecurityFocus (BID 103671†). Similar entries are available at VDB-68513, VDB-105483, VDB-105484 and VDB-105488. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Allegro

Name

• RomPager

Version

• 4.34

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion