Bugtraq: Re: ProFTPD

[pb () ECLIPSE CERTIX FR (pb () ECLIPSE CERTIX FR)]

Hi,
Note that user takes the value "Note that user takes the value "user () host" given at password prompt
for anonymous access (forgetting any potential dns attacks into remhost)
This allows anyone to smash the stack just with an anonymous access
and a file to download.
(see last published exploits.)

Regards,
Pascal

On Mon, Aug 30, 1999 at 07:42:44PM +1200, Nic Bellamy wrote:
> -  sprintf(buf,"%s %d %s %lu %s %c _ %c %c %s ftp 0 *\n",
> +  snprintf(buf,sizeof(buf),"%s %d %s %lu %s %c _ %c %c %s ftp 0 *\n",
>            fmt_time(time(NULL)),xfertime,remhost,fsize,
>            fname,xfertype,direction,access,user);
>
> To exploit the bug, the attacker must have permission to create
> directories and store files.
>
> Regards,
>       Nic.
>
> -- Nic Bellamy <sky () wibble net>
>    J. Random Coder.
--
Pascal Bouchareine
Administration systemes/reseaux - CERTIX
Tel: +33 1 40 34 43 57
Fax: +33 1 40 35 09 98