SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (File Transfer/Sharing)  >   oftpd Vendors:   Kerr, Shane et al
oftpd Can Be Crashed By Remote Users Sending a PORT Command
SecurityTracker Alert ID:  1009587
SecurityTracker URL:  http://securitytracker.com/id/1009587
CVE Reference:   CVE-2004-0376   (Links to External Site)
Updated:  Apr 4 2004
Original Entry Date:  Mar 29 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 0.3.6
Description:   A denial of service vulnerability was reported in oftpd. A remote user can cause the server to crash.

Philippe Oechslin reported that a remote user can cause the FTP service to crash by sending an FTP PORT command with a port number higher than 255. The oftpd daemon will then crash and must be manually restarted to return to normal operations.

As a demonstration exploit, the report indicates that you can telnet to the target FTP service on TCP port 21 and then type "port 300" with a return to cause the FTP service to crash.

Andreas Rueegg and Philippe Oechslin of the Security Bug Catcher project (http://lasecwww.epfl.ch/philippe.shtml) are credited with discovery.

Impact:   A remote user can cause the oftpd daemon to crash. The daemon must be manually restarted to return to normal operations.
Solution:   The vendor has released a fixed version (0.3.7), available at:

http://www.time-travellers.org/oftpd/oftpd-0.3.7.tar.gz
http://www.time-travellers.org/oftpd/

Vendor URL:  www.time-travellers.org/oftpd/oftpd-dos.html (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Mar 29 2004 (Gentoo Issues Fix) oftpd Can Be Crashed By Remote Users Sending a PORT Command
Gentoo has released a fix.
Apr 4 2004 (Debian Issues Fix) oftpd Can Be Crashed By Remote Users Sending a PORT Command
Debian has released a fix.



 Source Message Contents

Subject:  DoS vulnerability in oftpd [http://www.time-travellers.org/oftpd/oftpd-dos.html]


Hello Shane,

We have found a simple denial of service vulnerability in your oftpd FTP
server (v 0.3.6).

Vulnerability:

When the server receives a port command with a number that is higher than
255 the server crashes and has to be restarted manually. The port command
can even be given before the user has given a username and a password.

Consequence:

Denial of service. An ftp server can be taken offline with a simple telnet
connection.

Exploit:

telnet to ftp.server.com on port 21 and type "port 300" and return. The
server crashes.

Tested on:

- oftpd server 0.3.6 on Suse Linux 8.2


Discovered by: Andreas Rueegg and Philippe Oechslin of the Security Bug
Catcher project (http://lasecwww.epfl.ch/philippe.shtml). The security bug
catcher is a tool to automatically find vulnerabilities. We are currently
running tests on scores of FTP servers and notifying vendors when we find
something.

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC