[NT] CuteFTP Buffer Overflow in LIST's Response

From: support@securiteam.com
Date: 01/23/03

  • Next message: support@securiteam.com: "[UNIX] ftls.org Guestbook Script Injection Vulnerabilities" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 23 Jan 2003 18:12:06 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security would like to welcome Tiscali World Online
    to our service provider team.
    For more info on their service offering IP-Secure,
    please visit http://www.worldonline.co.za/services/work_ip.asp
    - - - - - - - - -

      CuteFTP Buffer Overflow in LIST's Response
    ------------------------------------------------------------------------

    SUMMARY

    When a FTP Server is responding to a "LIST" (directory listing) command,
    the response is sent over a data connection. Sending 257 bytes over this
    connection will cause a buffer to overflow, and the EIP register can be
    overwritten completely by sending 260 bytes of data.

    DETAILS

    Vulnerable systems:
     * CuteFTP 5.0 XP build 50.6.10.2

    Impact:
    This could allow arbitrary code to be executed on the remote victim's
    machine, if the attacker is successful in luring a victim onto his server.

    Vendor Status:
    Contacted GlobalSCAPE Jan 14th 2003, After a couple of emails back and
    forth within a few days, they confirmed the problem, and said they are
    working on a release for Monday (20th Jan, 03) which will address the
    issue.

    Solution:
    Upgrade to new version which should be available from Monday (20th Jan,
    03).

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:fitzies@hotmail.com> Lance
    Fitz-Herbert.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

    Relevant Pages

    • [UNIX] PHP Source Injection in osCommerce
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Would result in a directory listing of the current dierctory ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [EXPL] SLMail PASS Buffer Overflow
      ... The following exploit code can be used to test your SLMail ... # Discovered by: Muts # ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [EXPL] Xsun (Sparc) Local Exploit (RGB_DB)
      ... struct TREE { ... main(int argc, char *argv) ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [TOOL] BSD-AirTools, WEP Related Tools
      ... netstumbler (dstumbler) that can be used to detect wireless access points ... of the prism2 debug modes as well as do basic analysis of the ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [UNIX] Posix_getpw* Ignores Safe_mode and Open_basedir Settings
      ... thus allowing a user to rebuild a complete ... user to know what accounts have what privileges and what accounts have ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)