OFTPD User Command Buffer Overflow Vulnerability
BID:14161
Info
OFTPD User Command Buffer Overflow Vulnerability
| Bugtraq ID: | 14161 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 06 2005 12:00AM |
| Updated: | Jul 06 2005 12:00AM |
| Credit: | Discovery is credited to [email protected]. |
| Vulnerable: |
oftpd oftpd 0.3.7 oftpd oftpd 0.3.6 oftpd oftpd 0.3.5 oftpd oftpd 0.3.4 oftpd oftpd 0.3.3 oftpd oftpd 0.3.2 oftpd oftpd 0.3.1 oftpd oftpd 0.3 .0 |
| Not Vulnerable: | |
Discussion
OFTPD User Command Buffer Overflow Vulnerability
oftpd is prone to a remotely exploitable buffer overflow. This may be triggered by a client through an overly long argument for the USER command.
Successful exploitation may let a remote attacker execute arbitrary code in the context of the server process.
oftpd is prone to a remotely exploitable buffer overflow. This may be triggered by a client through an overly long argument for the USER command.
Successful exploitation may let a remote attacker execute arbitrary code in the context of the server process.
Exploit / POC
OFTPD User Command Buffer Overflow Vulnerability
The following example was provided to demonstrate the issue:
530 Only anonymous FTP supported.
ftp: Login failed.
ftp> user
(username)
usage: user username [password [account]]
ftp> user \0\0\0\0\0\ (much larger string)
500 Syntax error, command unrecognized.
Login failed.
ftp> user
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x30303054
0x969b56d8 in history ()
---
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
The following example was provided to demonstrate the issue:
530 Only anonymous FTP supported.
ftp: Login failed.
ftp> user
(username)
usage: user username [password [account]]
ftp> user \0\0\0\0\0\ (much larger string)
500 Syntax error, command unrecognized.
Login failed.
ftp> user
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x30303054
0x969b56d8 in history ()
---
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
OFTPD User Command Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.