Kerberos4 FTP Client Heap Overflow Lets Malicious Servers Execute Arbitrary Code on the FTP Client
|
Date: Apr 25 2002
|
Impact: Execution of arbitrary code via network, Root access via network, User access via network
|
Exploit Included: Yes
|
Version(s): krb4 ftp client, 4-1.1.1
|
Description: A heap overflow vulnerability was reported in the FTP client software that ships with Kerberos4. A remote server can cause arbitrary code to be executed on the client.
It is reported that there is a heap overflow. A remote server can reportedly respond to the client with a long reply in the place
of IP and port to cause a pasv buffer to overflow, as in the example below:
client: PASV
server: 227 food_for_the_poor (AAAAAAA...1323bytes...AAAAAA)
The
vulnerability reportedly exists in the file krb4-1.1.1/appl/ftp/ftp/ftp.c:
if (code == 227 || code == 229) {
char
*p, *q;
pasv[0] = 0;
p = strchr (reply_string, '(');
if (p) {
p++;
q = strchr(p, ')');
if(q){
memcpy (pasv, p, q - p); // <- heap overflow
pasv[q - p] = 0;
}
}
}
Some demonstration exploit code is available at:
http://www.freeweb.hu/mantra/04_2002/food_for_the_poor
.c
This appears to be a different problem than the previously reported buffer overflow in the krb5 FTP client (krb5-1.2.2), discussed
at:
http://web.mit.edu/kerberos/www/advisories/ftpbuf.txt
|
Impact: A remote FTP server can cause the FTP client to execute arbitrary code when executing the PASV command.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: web.mit.edu/kerberos/www/index.html (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: Marcell Fodor <m.fodor@mail.datanet.hu>
|
Message History:
None.
|
Source Message Contents
|
Date: 24 Apr 2002 20:13:23 -0000
From: Marcell Fodor <m.fodor@mail.datanet.hu>
Subject: A bug in the Kerberos4 ftp client may cause heap overflow which
|
Kerberos4 ftp client is a simple ftp client, with the
extensions defined by RFC 2228.
When authentication fails with AUTH, client will use
USER/PASS command as other ones.
A bug in the code may cause a heap overflow which leads to
remote code execution.
The overflow occurs when the server responds to client's
request for passive mode. If the server
responds with a long reply in the place of IP and port,
pasv buffer will overflow.
Affected version: 4-1.1.1
The real danger: an ftp server can simply modified to
recognize Kerberos4 ftp client by it's protocol. You know
the rest.
Details and exploit code: mantra.freeweb.hu
Marcell Fodor
|
|
