OpenFTPD Remote Message Format String Vulnerability
BID:10830
Info
OpenFTPD Remote Message Format String Vulnerability
| Bugtraq ID: | 10830 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 30 2004 12:00AM |
| Updated: | Jul 30 2004 12:00AM |
| Credit: | Discovery of this issue is credited to Thomas Wana <[email protected]>. |
| Vulnerable: |
OpenFTPD FTP Server 0.30.2 OpenFTPD FTP Server 0.30.1 OpenFTPD FTP Server 0.30 OpenFTPD FTP Server 0.29.4 |
| Not Vulnerable: | |
Discussion
OpenFTPD Remote Message Format String Vulnerability
Reportedly OpenFTPD is affected by a remote message format string vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input before using it as the format specifier in a formatted printing function.
Successful exploitation of this issue will allow an attacker to execute arbitrary code on the affected computer with the privileges of the user that invoked the affected FTP server software.
Reportedly OpenFTPD is affected by a remote message format string vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input before using it as the format specifier in a formatted printing function.
Successful exploitation of this issue will allow an attacker to execute arbitrary code on the affected computer with the privileges of the user that invoked the affected FTP server software.
Exploit / POC
OpenFTPD Remote Message Format String Vulnerability
The following exploit has been provided by [email protected]:
The following exploit has been provided by [email protected]:
Solution / Fix
OpenFTPD Remote Message Format String Vulnerability
Solution:
It has been reported that the vendor has provided the following patch; this has not been confirmed. It should be noted that Symantec has not tested this patch.
cat > openftpd_formatstring.patch << _EOF_
--- openftpd-daily.orig/src/misc/msg.c 2004-07-05 22:02:43.000000000 +0200
+++ openftpd-daily/src/misc/msg.c 2004-07-13 18:05:01.000000000 +0200
@@ -319,7 +319,7 @@
while (fgets(buff, 67, file)) {
if (*(buff+strlen(buff)-1) == '\n') *(buff+strlen(buff)-1) = 0;
sprintf(str, " !C| !0%-66s !C|!0\n", buff);
- printf(str);
+ printf("%s", str);
}
fclose(file);
printf("!C \\__________________________________________________!Hend of message!C__/!0\n");
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
It has been reported that the vendor has provided the following patch; this has not been confirmed. It should be noted that Symantec has not tested this patch.
cat > openftpd_formatstring.patch << _EOF_
--- openftpd-daily.orig/src/misc/msg.c 2004-07-05 22:02:43.000000000 +0200
+++ openftpd-daily/src/misc/msg.c 2004-07-13 18:05:01.000000000 +0200
@@ -319,7 +319,7 @@
while (fgets(buff, 67, file)) {
if (*(buff+strlen(buff)-1) == '\n') *(buff+strlen(buff)-1) = 0;
sprintf(str, " !C| !0%-66s !C|!0\n", buff);
- printf(str);
+ printf("%s", str);
}
fclose(file);
printf("!C \\__________________________________________________!Hend of message!C__/!0\n");
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.