mailing list archives
Think of the buffers! Won't somebody think of the buffers?!
From: "Hugh Mann" <hughmann () hotmail com>
Date: Tue, 23 Mar 2004 07:09:34 +0000
Advisory Name: Think of the buffers! Won't somebody think of the buffers?!
Impact : Arbitrary code execution as SYSTEM
Discovered by: Hugh Mann hughmann () hotmail com
Tested progs : Ipswitch WS_FTP Server 4.0.2.EVAL
A remote user who has write access to a directory can execute arbitrary code
due to a buffer overflow in WS_FTP Server's STAT command when downloading a
file the user created. This is difficult to exploit since the username would
have to be pretty long. If the user has more privilege and can change its
username it's easily exploited.
There are four types of user privileges. In order of user with highest
1. FTP System Administrator users (can change everything)
2. FTP Host Administrator users (can change everyhing on his/her FTP host)
4. Anonymous users
Only (1) and (2) can change a user's name. (3) would most likely have to ask
(1) or (2) to change the username to a much longer name to exploit this, but
if the FTP host name is really long it may not be necessary. So to be 100%
sure we can exploit this, the user must be (2) because (2) can add users and
change their names. A remote (1) can already execute arbitrary files.
A FTP host administrator must log in with the XAUT FTP command or he/she
won't be able to use any useful SITE commands. Apparently Ipswitch thinks
the "encrypted" XAUT string is much safer than plaintext USER/PASS.
The stack-based buffer overflow occurs whenever the user uploads/downloads a
file and at the same time sends a STAT command (no options). The WS_FTP
Server sends a 211 reply with the status of the download. This string
contains the FTP host name, IP address, username, filename, and number of
bytes sent/left. This is a long string (more than 200 unformatted bytes)
which, with any filename and possibly a long FTP hostname / username, can
overflow a 512-byte buffer on the stack. "filename" is exactly the same
filename string the user asked the FTP server to send. The filename contains
the shellcode and can be max 256 characters long.
See the attached source code.
Find a broadband plan that fits. Great local deals on high-speed Internet
- Think of the buffers! Won't somebody think of the buffers?! Hugh Mann (Mar 23)