Netsupport gateway remote DoS

[watcher60@xxxxxxxxxxx]

Vendor: Netsupport
Product: Netsupport Manager
Vendor contacted 11 Nov 2009, fixed 11 Jan 2010 in version 10.60.0006

Netsupport gateway is a feature packaged with the netsupport manager 
product."Delivering seamless Remote Control between PCs that may be located 
behind different firewalls. The NetSupport Gateway provides a stable and secure 
method for NetSupport enabled systems to locate and communicate via http."

In all versions prior to 10.60.0006 it is possible to remotely crash the 
service by simply telneting to the port and hitting return twice, thereby 
causing a DoS. In versions prior to 10.60.0005 this would only work from linux 
or mac hosts, however in 10.60.0005 (which was an attempt to fix the issue) it 
resulted in this working from both linux, mac & windows hosts. This variation 
was down to the differnces in carriage returns between OS's. I presume that the 
root issue was providing null header information though the vendor never 
confirmed.

regards

Matthew Whitehead (watcher60)