ACLogic CesarFTP Buffer Overflow Vulnerability

Bugtraq ID:	11070
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 30 2004 12:00AM
Updated:	Aug 30 2004 12:00AM
Credit:	lion <[email protected]> disclosed this vulnerability.
Vulnerable:	ACLogic CesarFTP 0.99 g ACLogic CesarFTP 0.99 e ACLogic CesarFTP 0.98 b - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 j - Microsoft Windows 95 Build 490.R6 - Microsoft Windows 95 - Microsoft Windows 98 j - Microsoft Windows 98 b - Microsoft Windows 98 a - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 3.5.1 SP5 - Microsoft Windows NT 3.5.1 SP4 - Microsoft Windows NT 3.5.1 SP3 - Microsoft Windows NT 3.5.1 SP2 - Microsoft Windows NT 3.5.1 SP1 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 3.5
Not Vulnerable:

ACLogic CesarFTP Buffer Overflow Vulnerability

It is reported that CesarFTP is susceptible to a buffer overflow vulnerability. This vulnerability is due to a lack of proper bounds checking in the application. This leads to a buffer of fixed size being overrun, corrupting the contents of adjacent memory regions.

It is reported that this vulnerability is exploitable before authenticating to the FTP server, allowing anonymous attackers to either crash the FTP server, or possibly to execute arbitrary code in the context of the FTP server process.

ACLogic CesarFTP Buffer Overflow Vulnerability

A proof of concept exploit sufficient to crash the affected application was provided by <[email protected]>:

• /data/vulnerabilities/exploits/cesarftp_dos.c

ACLogic CesarFTP Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ACLogic CesarFTP Buffer Overflow Vulnerability

References:

• Cesar FTP Server Long Command DoS Exploit (CNHonker)
  
• CesarFTP Homepage (ACLogic)