[NT] Buffer Overflow Vulnerabilities in TurboFTP

From: SecuriTeam (support_at_securiteam.com)
Date: 07/14/03

  • Next message: SecuriTeam: "[REVS] Win32 Message Vulnerabilities Redux" 
    To: list@securiteam.com
Date: 14 Jul 2003 12:54:11 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security in Canada

    Toronto-based Sunrays Technologies is now Beyond Security's representative in Canada.
    We welcome ISPs, system integrators and IT systems resellers
    to promote the most advanced vulnerability assessment solutions today.

    Contact us at 416-482-0038 or at canadasales@beyondsecurity.com

    - - - - - - - - -

      Buffer Overflow Vulnerabilities in TurboFTP
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.turboftp.com> TurboFTP is "a secure FTP client program for
    Windows 9x/ME/NT4/2000/XP. It allows you to transfer files (upload or
    download) at turbo speed between your computer and virtually any FTP
    server with exceptional ease". The product has been found to be vulnerable
    to a buffer overflow attack from a malicious FTP server (a malicious FTP
    server sending an overly long response upon at any time during the
    connection).

    DETAILS

    Vulnerable systems:
     * TurboFTP version 3.85 Build 304

    Example:
    (TurboFTP connected...)
    220 [1061xA]
    (Access violation in user32.dll)

    (TurboFTP connected...)
         PADDING EIP
    220 [1061xA][*][2xX] // Totalling 1063 Bytes
    (Access violation in turboftp.exe when executing 0x00580058)
    // 2xX Unicoded

    * The base pointer register cannot be altered as far as I can see, thus
    the reason I have not included it.

    (TurboFTP connected...)
         PADDING
    220 [8000xA]
    (Access violation in comctl32.dll)

    (TurboFTP connected...)
         PADDING EAX
    220 [8574xA][4xX] // Totalling 8578 Bytes
    (Access violation in turboftp.exe; EAX = 0x58585858)

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:peter4020@hotmail.com> Peter
    Winter-Smith.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[REVS] Win32 Message Vulnerabilities Redux"