Re: proftpd format bug

From: Jose Nazario (joseat_private)
Date: Sun Dec 09 2001 - 15:50:36 PST

  • Next message: Valdis.Kletnieksat_private: "Re: character injecting on linux console"

    On Sun, 4 Dec 2005, Fuska wrote:
    
    >   Sorry if this has been already reported.
    
    > ftp> quote site %p
    > 500 'SITE 0X8055F1E' not understood.
    > ftp> quote site %s
    > 421 Service not available, remote server has closed connection
    
    to differentiate between a client and a server bug, please use a client
    like netcat or telnet:
    
    $ nc server 21
    220 server.site.edu NcFTPd Server (free educational license)
    ready.
    user anonymous
    331 Guest login ok, send your complete e-mail address as password.
    pass jose@
    230-You are user #1 of 50 simultaneous users allowed.
    230 Logged in anonymously.
    
    cwd %n
    550 No such directory.
    
    
    hope this helps. this is a common issue with ftp string format atacks,
    people finding client bugs and thinking they're server bugs. please do
    this test to find out which it is.
    
    ____________________________
    jose nazario						     joseat_private
    	      	     PGP: 89 B0 81 DA 5B FD 7E 00  99 C3 B2 CD 48 A0 07 80
    				       PGP key ID 0xFD37F4E5 (pgp.mit.edu)
    



    This archive was generated by hypermail 2b30 : Sun Dec 09 2001 - 16:55:45 PST