Tiny FTPd Multiple Buffer Overflow Vulnerabilities
BID:961
Info
Tiny FTPd Multiple Buffer Overflow Vulnerabilities
| Bugtraq ID: | 961 |
| Class: | Unknown |
| CVE: |
CVE-2000-0133 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 01 2000 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | Discovered by UNYUN <[email protected]>, posted to Bugtraq-JP onJanuary 27, 2000. Translation posted to Bugtraq by Nobuo Miwa. |
| Vulnerable: |
H. Nomura Tiny FTPDaemon 0.52 |
| Not Vulnerable: | |
Discussion
Tiny FTPd Multiple Buffer Overflow Vulnerabilities
Tiny FTPd is a freeware FTP server for Win9x with a Japanese interface. Version .52 and possible previous versions have unchecked buffers in the code that handles the following commands: APPE, MKD, RMD, RNFR, RNTO, SIZE, STOR, XMKD, and XRMD. With these overflows, an attacker can overwrite the stack and execute arbitrary code.
Tiny FTPd is a freeware FTP server for Win9x with a Japanese interface. Version .52 and possible previous versions have unchecked buffers in the code that handles the following commands: APPE, MKD, RMD, RNFR, RNTO, SIZE, STOR, XMKD, and XRMD. With these overflows, an attacker can overwrite the stack and execute arbitrary code.
Exploit / POC
Tiny FTPd Multiple Buffer Overflow Vulnerabilities
This exploit will use the STOR overflow to create a registry key named 'backsection.net' in
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ In that key it will create an entry named "http" with a value of "0". This will set IE to not apply security settings against pages coming from backsection.net . The exploit then starts IE and loads http://shadowpenguin.backsection.net/ocx/sample.html . ActiveX code will then pop up a message box.
This exploit was only tested on Windows 98 with IE5. Usage under Windows NT will require some editing of the registry key location.
This exploit will use the STOR overflow to create a registry key named 'backsection.net' in
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ In that key it will create an entry named "http" with a value of "0". This will set IE to not apply security settings against pages coming from backsection.net . The exploit then starts IE and loads http://shadowpenguin.backsection.net/ocx/sample.html . ActiveX code will then pop up a message box.
This exploit was only tested on Windows 98 with IE5. Usage under Windows NT will require some editing of the registry key location.
Solution / Fix
Tiny FTPd Multiple Buffer Overflow Vulnerabilities
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
Tiny FTPd Multiple Buffer Overflow Vulnerabilities
References:
References: