RhinoSoft Serv-U FTP Server MDTM Command Stack Overflow Vulnerability

Bugtraq ID:	9483
Class:	Boundary Condition Error
CVE:	CVE-2004-2111
Remote:	Yes
Local:	No
Published:	Jan 24 2004 12:00AM
Updated:	Jul 12 2009 02:06AM
Credit:	Discovery is credited to kkqq <[email protected]>.
Vulnerable:	Rhino Software Serv-U 4.1 .0.11 Rhino Software Serv-U 4.1 Rhino Software Serv-U 4.0 .0.4 Rhino Software Serv-U 3.1 Rhino Software Serv-U 3.0
Not Vulnerable:	Rhino Software Serv-U 4.2

RhinoSoft Serv-U FTP Server MDTM Command Stack Overflow Vulnerability

RhinoSoft Serv-U FTP Server is reportedly prone to a buffer overflow. The issue exists when a 'site chmod' command is issued on a non-existant file. If an excessively long filename is specified for the command, an internal buffer will be overrun, resulting in a failure of the FTP server. Execution of arbitrary code may be possible.

RhinoSoft Serv-U FTP Server MDTM Command Stack Overflow Vulnerability

Exploits have been contributed by the following authors:

mandragore
mslug
lion (**Updated exploit available that attacks XP based hosts)
SkyLined

• /data/vulnerabilities/exploits/mandragore-servuex.c
• /data/vulnerabilities/exploits/mslug-servu.c
• /data/vulnerabilities/exploits/Servu.c
• /data/vulnerabilities/exploits/serv-ME.c
• /data/vulnerabilities/exploits/serv-u_ftpd_exp.c

RhinoSoft Serv-U FTP Server MDTM Command Stack Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

This issue is reportedly not present in versions of Serv-U FTP Server greater than 4.2. This has not been confirmed by Symantec.

RhinoSoft Serv-U FTP Server MDTM Command Stack Overflow Vulnerability

References:

• Serv-U Homepage (RhinoSoft)