[Full-disclosure] Denial of Service vulnerability in Cewolf

["MustLive" <mustlive@xxxxxxxxxxxxxxxxxx>]

Hello list!

I want to warn you about Denial of Service vulnerability in Cewolf - Chart
Enabling Web Object Framework.

This servlet is using as at individual sites, as in different CMS. Besides
Cewolf itself, also those web applications are vulnerable which are using
it, such as Megapolis.Portal Manager, Inca and other web applications.

-------------------------
Affected products:
-------------------------

Vulnerable are Cewolf 1.1.4 and previous versions, all versions of
Megapolis.Portal Manager, Inca 2.5 and previous versions. And also all web
applications which are using Cewolf.

If developers of Cewolf and Megapolis.Portal Manager ignored this
vulnerability, then developers of Inca answered me and stated that they
would fix it.

----------
Details:
----------

Denial of Service (WASC-10):

http://site/path/cewolf?img=1&width=10000&height=10000

By using large values in parameter width, height or in both parameters it's
possible to consume the whole memory of the server.

At some sites, which are using Inca, there is limitation set on using of
memory by Java-servlets, which slightly protects them from this attack. But
all sites with Megapolis.Portal Manager haven't such limitations.

------------
Timeline:
------------

2010.12.25 - informed developers of Megapolis.Portal Manager.
2010.12.25 - announced at my site.
2010.12.25-26 - informed developers of Cewolf or three different e-mails.
2010.12.26 - informed developers of Inca.
2011.01.31 - received answer from developers of Inca.
2011.02.24 - disclosed at my site.

I mentioned about this vulnerability at my site
(http://websecurity.com.ua/4791/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/