full-disclosure - NULL pointer in SurgeFTP 2.3a2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20080225231112.890d7347.aluigi@autistici.org>
Date: Mon, 25 Feb 2008 23:11:12 +0100
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, news@...uriteam.com,
	full-disclosure@...ts.grok.org.uk, vuln@...unia.com,
	packet@...ketstormsecurity.org
Subject: NULL pointer in SurgeFTP 2.3a2

#######################################################################

                             Luigi Auriemma

Application:  SurgeFTP
              http://www.netwinsite.com/surgeftp/
Versions:     <= 2.3a2
Platforms:    Windows, Linux and Solaris
Bug:          NULL pointer access
Exploitation: remote
Date:         25 Feb 2008
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    aluigi.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

SurgeFTP is a commercial FTP server which supports also SSL/TLS and has
a web interface for remote administration.

#######################################################################

======
2) Bug
======

When a Content-Length parameter is received from the client, SurgeFTP
tries to allocate the amount of memory (max 2147483647 bytes) specified
in this field and then copies the data in the resulted new buffer.
The problem is in the lack of checks on the result of the allocation
which leads to the crash of the entire server during the copying of the
data to a NULL pointer if that amount of memory cannot be allocated.

#######################################################################

===========
3) The Code
===========

http://aluigi.org/poc/surgeftpizza.txt

  nc SERVER 7021 -v -v < surgeftpizza.txt

#######################################################################

======
4) Fix
======

No fix

#######################################################################

--- 
Luigi Auriemma
http://aluigi.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/