Vulnerability Development: Re: iis (ftp) 4.0

[Renaud Deraison <deraison () CVS NESSUS ORG>]

On Sun, 30 Jul 2000, Guilherme Mesquita wrote:

> hey doods take a look at this:
> ftp> quote cd
> %f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f
> 421 Service not available, remote server has closed connection
> ftp>
The problem comes from your ftp client, which is vulnerable to malformed
input.

For the Linux ftp client that comes with NetKit-something, in the file
cmds.c, line 1665 there is :

!       if (command(buf) == PRELIM) {

Whereas it should be :

!       if (command("%s", buf) == PRELIM) {


As for the FTP server closing the connection, it's how Microsoft's FTP
server work: if you issue a too long argument, they'll close the
connection at you.


                                -- Renaud

--
Renaud Deraison
The Nessus Project
http://www.nessus.org