War-FTPd 1.6x CWD/MKD DoS Vulnerability

Bugtraq ID:	966
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Feb 03 2000 12:00AM
Updated:	Feb 03 2000 12:00AM
Credit:	Discovered and posted to Bugtraq on February 2, 2000 by Toshimi Makino <[email protected]>.
Vulnerable:	Jgaa WarFTPd 1.67 -3 Jgaa WarFTPd 1.66 x4s
Not Vulnerable:	Jgaa WarFTPd 1.71 Jgaa WarFTPd 1.67 -4

War-FTPd 1.6x CWD/MKD DoS Vulnerability

War-FTPd 1.67 and possibly previous versions are susceptible to a buffer overflow DoS attack.

Due to improper bounds checking in the code that handles MKD and CWD commands, it is possible to remotely crash the server by submitting extremely long pathnames as arguments to either command.

War-FTPd 1.6x CWD/MKD DoS Vulnerability

An exploit has been made available.

• /data/vulnerabilities/exploits/warftpd-dos.c

War-FTPd 1.6x CWD/MKD DoS Vulnerability

Solution:
Version 1.67-4 has been patched against this vulnerability, and is available at:
http://war.jgaa.com/alert/files/ward167-4.zip
Also, upgrading to version 1.71 will fix this problem. 1.71 is available at:
http://war.jgaa.com/alert/files/ward171-0.zip

These versions have a sanity check that prevents arguments longer than the length specified in the MAX_PATH variable from being accepted.

War-FTPd 1.6x CWD/MKD DoS Vulnerability

References:

• SECURITY ALERT - WAR FTP DAEMON ALL VERSIONS (Jgaa)
  
• WarFTP Homepage (Jgaa)