mailing list archives
Re: How to crash a harddisk - the Ipswitch WS_FTP Server way
From: exon <exon () home se>
Date: Wed, 24 Mar 2004 00:19:49 +0100
This is old news.
It is also RFC compliant behaviour, even though admitted silly.
Hugh Mann wrote:
Advisory Name: How to crash a harddisk - the Ipswitch WS_FTP Server way
Impact : Denial of Service
Discovered by: Hugh Mann hughmann () hotmail com
Tested progs : Ipswitch WS_FTP Server 4.0.2.EVAL
It's possible for any user with write access to a directory, even when
there's a limit to how much data the user can upload, to use up all
available disk space on any partition it can upload to. Even a slow
modem user can do this because the user only needs to send a few bytes
to the server.
The REST command is used to change the file pointer where new data
will be written to the file next time the user sends an upload command
such as STOR. A user can create arbitrary sized files (up to 2^64-1
bytes) by specifying a large value as the argument to REST and then
sending a small file with STOR.
WS_FTP Server doesn't count the extra bytes starting from the end of
the original file to the new file pointer location when checking if
the user can upload more bytes. The next time the user tries to upload
a file, WS_FTP Server will give an error.
Save this in a file called ftpcmds.txt, after changing the FTP server
name, username, and password.
quote REST 1073741822
Then start it:
to see the result. It will create a 1GB file and then delete it.
Is your PC infected? Get a FREE online computer virus scan from
Full-Disclosure - We believe in it.