Windows NTP Time Server Syslog Monitor 1.0.000 Denial of Service Vulnerability

[vuln_research@xxxxxxxxxxxxxxxxxxx]

[--Vulnerability Summary--]

Title: Windows NTP Time Server Syslog Monitor 1.0.000 Denial of Service 
Vulnerability
Product: Windows NTP Time Server Syslog Monitor 1.0.000

Discovered: November 29, 2008
Discovered by: Rob Kraus, princeofnigeria (PoN)

Vendor: TimeTools
Vendor URL: http://www.timetools.co.uk
Vendor notification date: December 1, 2008
Vendor response date: --
Vendor acknowledgment:--
Vendor provided fix:--
Release coordinated with the vendor: --
Public disclosure date: January 14, 2009

Affects: Windows NTP Time Server Syslog Monitor 1.0.000
Fixed in: No fix currently available.
Risk: High

Vulnerability Description: Windows NTP Time Server Syslog Monitor 1.0.000 is 
vulnerable to a remote denial-of-service vulnerability because it fails to 
handle user-supplied input. Sending a specially crafted UDP Syslog request will 
cause the application to become unstable and stop responding.

Impact: A remote or local attacker can exploit this flaw by sending a specially 
crafted packet to the Syslog server. Successful exploitation of this flaw will 
cause the Syslog server process to crash preventing valid users or devices from 
using the service. The Syslog server will need to be restarted to resume normal 
Syslog server operations.

Keywords: security, vulnerability, syslog, princeofnigeria, windows, server, 
udp, dos, denial of service

[--Background--]

Type of vulnerability: Input validation flaw
Who can exploit it: Local or Remote users

Windows NTP Time Server Syslog Monitor 1.0.000 is an application that provides 
services for receiving system event messages to provide a centralized reporting 
interface for distributed system events. The application should validate and 
sanitize all user input to prevent unexpected conditions.

Per software download sites description: ?TimeTools Windows Atomic Clock NTP 
Server Syslog Daemon is a free utility that runs on any Windows NT/2000/XP/2003 
workstation or server. It allows any syslog messages from any Linux or Unix 
based syslog client to be logged and displayed.?

Vulnerability Scope: The default installation of Windows NTP Time Server Syslog 
Monitor 1.0.000 will allow exploitation of this vulnerability.

[--More Details--]

Exploitation of this flaw can be executed by sending a specially crafted UDP to 
the target server. No exploit code is required.

[--Fix or Workaround Information--]

Patch availability: None
Vendor provided fix: None
Workarounds: None available at this time, design flaw. Discontinue use of this 
product until a stable patch is released.

[--Disclosure Policy--]

PrinceofNigeria.org Vulnerability Disclosure Policy
http://www.princeofnigeria.org/blogs/index.php/vulndev/vulnreleasepolicy/?blog=1

[--Disclosure History--]

Public disclosure date: January 14, 2009

[--References--]
CVE-ID:
Bugtraq ID:
Secunia ID:
OSVDB ID:

[--Author--]
Rob Kraus, princeofnigeria (PoN)
Website: www.princeofnigeria.org/blogs