full-disclosure - Re: War-ftpd bug small addition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <000901c5064b$a57354c0$0100a8c0@grotedoos>
From: skylined at edup.tudelft.nl (Berend-Jan Wever)
Subject: Re: War-ftpd bug small addition

This is (obviously) a format string vulnerability. (Un)fortunately war-ftpd.exe has it's own implementation of printf-functions that doesn't support "%n" -> No arbitrary overwrites.
The formatstring and destination string are on the heap and the destination is dynamically allocated --> no buffer overflows.
All in all: no code execution.

Vulnerabilities:
Commands such as "USER %9999999999d%9999999999d%999999999999d" will consume a lot of CPU and memory, thus causing a DoS on the system and not just War-ftpd. (Maybe Secunia want to update their rating again.)
Commands such as "USER %s%s%s%s%s....%s%s" are bound to run into a dword that doesn't point to allocated memory, thus causing a DoS on War-ftpd itself.

To exploit this format string vuln, the target War-ftpd.exe needs to run as a service since it resides in one of the logging functions that it only uses when running as a service.

Cheers,

SkyLined

Berend-Jan Wever <skylined@...p.tudelft.nl>
TTP: http://www.edup.tudelft.nl/~bjwever
MSN: skylined@...p.tudelft.nl
IRC: SkyLined in #SkyLined on EFNET
PGP: key ID 0x48479882

----- Original Message ----- 
From: "class 101" <class101@...-squad.com>
To: <full-disclosure@...ts.netsys.com>
Sent: Friday, January 28, 2005 18:58
Subject: [Full-Disclosure] War-ftpd bug small addition

To fix the buggus advisory spreaded everywhere saying that you need to be authenticated, It's false Mc.Iglo ;)

USER %s*115AAAAA
PASS blahblah

http://secunia.com/advisories/14054/

-------------------------------------------------------------
class101
Jr. Researcher
Hat-Squad.com
-------------------------------------------------------------

--------------------------------------------------------------------------------

> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>