[NT] Serv-U MDTM Command Buffer Overflow Vulnerability
From: SecuriTeam (support_at_securiteam.com)
Date: 03/01/04
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 1 Mar 2004 18:46:00 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Serv-U MDTM Command Buffer Overflow Vulnerability
------------------------------------------------------------------------
SUMMARY
<http://www.serv-u.com/> Serv-U is a "powerful, easy-to-use,
award-winning FTP server" created by Rob Beckers.
The popular Windows FTP server contains a buffer overflow condition when
processing the MDTM command. A logged user can send a malformed timezone
argument to the MDTM command and invoke the vulnerability. A specially
crafted argument will allow the user to gain SYSTEM privileges.
DETAILS
Vulnerable Systems:
* Serv-U version 5.0
Immune Systems:
* Serv-U version 5.0.0.4
After a successful login, a user may enter the following (or equivalent)
command:
MDTM 20031111111111+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
/test.txt
Of course, one has to log in to the FTP server before the vulnerability
can be exploited. However, no special privileges, such as write
permissions, are needed in order to exploit the vulnerability. In fact,
the test.txt file itself doesn't even have to exist on the server. It is
enough to send a long MDTM command to the server.
Patch Availability:
The vendor has been contacted and a new version of Serv-U FTP is
available. It is highly advisable to upgrade to version 5.0.0.4.
ADDITIONAL INFORMATION
The information has been provided by <mailto:bkbll@cnhonker.net> bkbll.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
