Gene6 BPFTP FTP Server User Credentials Disclosure Vulnerability

Bugtraq ID:	2534
Class:	Environment Error
CVE:	CVE-2001-0264
Remote:	Yes
Local:	No
Published:	Apr 03 2001 12:00AM
Updated:	Jul 11 2009 06:06AM
Credit:	Discovered by Rob Beck [[email protected]] on April 3, 2001.
Vulnerable:	Gene6 G6 FTP Server 2.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:	Gene6 BPFTP Server 2.10 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0

Gene6 BPFTP FTP Server User Credentials Disclosure Vulnerability

G6 FTP Server now known as BPFTP Server is an internet FTP server by Gene6

If a logged in FTP user connects to an external share and submits a malformed 'size' or 'mdtm' command, the user could force the FTP server to make an external SMB connection.

The FTP server must provide login credentials of the user the server is running under in order to make a connection to the remote host. A password hash is sent across the external connection to the host. A third party network utility could be listening for internal and external traffic and capture the password hash. The captured hash could be resolved into the username and password.

Gene6 BPFTP FTP Server User Credentials Disclosure Vulnerability

The following exploit has been provided by Rob Beck [[email protected]] from @stake:

• /data/vulnerabilities/exploits/g6-2nbt.pl

Gene6 BPFTP FTP Server User Credentials Disclosure Vulnerability

Solution:
Gene6 has addressed this issue in BPFTP Server v2.10:


Gene6 G6 FTP Server 2.0

• Gene6 postdown
  http://www.bpftpserver.com/postdown.html

Gene6 BPFTP FTP Server User Credentials Disclosure Vulnerability

References:

• BPFTP Server Homepage (Gene6)
  
• Multiple Information Disclosure Issues with G6 FTP Server (@stake)