bugtraq - Buffer-overflow in Jordan's telnet server

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20031229181857.637db518.aluigi@altervista.org>
Date: Mon, 29 Dec 2003 18:18:57 +0000
From: Luigi Auriemma <aluigi@...ervista.org>
To: bugtraq@...urityfocus.com
Subject: Buffer-overflow in Jordan's telnet server



#######################################################################

                             Luigi Auriemma

Application:  Jordan's Windows Telnet server
              http://www.jordan.com/WindowsTelnetServer
Versions:     1.0 (but the same version is also identified as 1.2)
Platform:     Windows
Bug:          buffer overflow
Risk:         high
Exploitation: remote
Date:         29 Dec 2003
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Windows Telnet Server (Wtsd) is a small commercial telnet server
written by Jordan Stojanovski.


#######################################################################

======
2) Bug
======


The bug is a remote buffer-overflow in the client's login procedure.
Practically an username of 518 bytes fully overwrites the return
address of the vulnerable function.
The problem happens in the unchecked copy of the buffer containing the
string received from the socket to the new smaller buffer:

:00406281 F3A5                    rep movsd

(instruction's offset of the demo version)


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/jordwts.zip


#######################################################################

======
4) Fix
======


No replies from the author.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org