full-disclosure - freeftpd MKD buffer overflow etc...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <981281b10511170142k5748976fhd175b780852af8c7@mail.gmail.com>
Date: Thu Nov 17 10:32:18 2005
From: barbsie at gmail.com (barabas mutsonline)
Subject: freeftpd MKD buffer overflow etc...

Hi,
 I turned off logging on my freeftpd server as a temporary fix for the USER
problem. Pfew...I felt more comfortable now. 3v17 h4x0r5 won't be able to
compromise my collection of Adriana Lima pics anymore.
But...while I was thinking on how to write a l33t3r PoC, I picked my nose,
and a giant booger fell on my keyboard just whilst I was creating a daily
directory of pictures. It hit the A-key and send a long MKD string to my
freeftpd server and crashed it (7 gram booger = +- 1024 A's). Godd4mn! This
even without turning logging on! SEH was overwritten again.
I restarted the server and got really mad. Trying to remove the booger from
between my keys something amazing happened: A very long DELE command was
send and the server died again.
 I give up. Maybe I'll use scp and blow my nose?
 I'll leave it up to Class101 to write l33t PoC code. His kungfu is better
and he codes in C, which is l33t3r anyway.
 cheers
 barabas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051117/02d0276a/attachment.html