Mabry Software FTPServer/X Controls Format String Vulnerability
BID:9402
Info
Mabry Software FTPServer/X Controls Format String Vulnerability
| Bugtraq ID: | 9402 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 12 2004 12:00AM |
| Updated: | Jan 12 2004 12:00AM |
| Credit: | The disclosure of this issue has been credited to securma massine <[email protected]>. Jan-Olivier Fillols and Philippe Oechslin discovered the issue in PlatinumFTPServer. |
| Vulnerable: |
PlatinumFTP PlatinumFTPserver 1.0.18 Mollensoft Software Hyperion FTP Server 3.5.3 Mabry Software FTPServer/X 1.0 .05 |
| Not Vulnerable: | |
Discussion
Mabry Software FTPServer/X Controls Format String Vulnerability
It has been reported that FTPServer/X may be prone to a remote format string vulnerability when processing a malicious request from a client. The vulnerability presents itself when the server receives a malicious request containing embedded format string specifiers from a remote client when supplying a username during FTP authentication. This could be exploited to crash the server but could also theoretically permit corruption/disclosure of memory contents and execution of arbitrary code.
FTPServer/X COM Object version 1.00.050 has been reported to be vulnerable to this issue, however, other versions could be affected as well. It should be noted that any software that implements the Mabry Software FTPServer/X control, is likely affected by this vulnerability. It has been confirmed that this control is in use by Mollensoft(Hyperion) FTP Server.
The vulnerable control is also used by PlatinumFTPServer, which is also vulnerable to this issue. It is noted that other FTP commands such as 'mkdir' and 'rename' are also affected by this issue.
It has been reported that FTPServer/X may be prone to a remote format string vulnerability when processing a malicious request from a client. The vulnerability presents itself when the server receives a malicious request containing embedded format string specifiers from a remote client when supplying a username during FTP authentication. This could be exploited to crash the server but could also theoretically permit corruption/disclosure of memory contents and execution of arbitrary code.
FTPServer/X COM Object version 1.00.050 has been reported to be vulnerable to this issue, however, other versions could be affected as well. It should be noted that any software that implements the Mabry Software FTPServer/X control, is likely affected by this vulnerability. It has been confirmed that this control is in use by Mollensoft(Hyperion) FTP Server.
The vulnerable control is also used by PlatinumFTPServer, which is also vulnerable to this issue. It is noted that other FTP commands such as 'mkdir' and 'rename' are also affected by this issue.
Exploit / POC
Mabry Software FTPServer/X Controls Format String Vulnerability
The following proof of concept has been supplied for PlatinumFTPServer:
user %s%s%s%s
mkdir %s%s%s%s
rename filename %s%s%s%s
The following proof of concept has been supplied for PlatinumFTPServer:
user %s%s%s%s
mkdir %s%s%s%s
rename filename %s%s%s%s
Solution / Fix
Mabry Software FTPServer/X Controls Format String Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Mabry Software FTPServer/X Controls Format String Vulnerability
References:
References:
- FTPServer/X Homepage (Marby Software)
- PlatinumFTPserver Product Page (PlatinumFTP)
- PlatinumFTP 1.0.18 remote DoS (ports