oftpd Can Be Crashed By Remote Users Sending a PORT Command
|
|
SecurityTracker Alert ID: 1009587
|
|
CVE Reference: CAN-2004-0376
(Links to External Site)
|
Updated: Apr 4 2004
|
Original Entry Date: Mar 29 2004
|
Impact: Denial of service via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 0.3.6
|
Description: A denial of service vulnerability was reported in oftpd. A remote user can cause the server to crash.
Philippe Oechslin reported that a remote user can cause the FTP service to crash by sending an FTP PORT command with a port number
higher than 255. The oftpd daemon will then crash and must be manually restarted to return to normal operations.
As a demonstration
exploit, the report indicates that you can telnet to the target FTP service on TCP port 21 and then type "port 300" with a return
to cause the FTP service to crash.
Andreas Rueegg and Philippe Oechslin of the Security Bug Catcher project (http://lasecwww.epfl.ch/philippe.shtml)
are credited with discovery.
|
Impact: A remote user can cause the oftpd daemon to crash. The daemon must be manually restarted to return to normal operations.
|
Solution: The vendor has released a fixed version (0.3.7), available at:
http://www.time-travellers.org/oftpd/oftpd-0.3.7.tar.gz
http://www.time-travellers.org/oftpd/
|
Vendor URL: www.time-travellers.org/oftpd/oftpd-dos.html (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: Philippe Oechslin <philippe.oechslin@epfl.ch>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 04 Mar 2004 22:48:49 +0100
From: Philippe Oechslin <philippe.oechslin@epfl.ch>
Subject: DoS vulnerability in oftpd [http://www.time-travellers.org/oftpd/oftpd-dos.html]
|
Hello Shane,
We have found a simple denial of service vulnerability in your oftpd FTP
server (v 0.3.6).
Vulnerability:
When the server receives a port command with a number that is higher than
255 the server crashes and has to be restarted manually. The port command
can even be given before the user has given a username and a password.
Consequence:
Denial of service. An ftp server can be taken offline with a simple telnet
connection.
Exploit:
telnet to ftp.server.com on port 21 and type "port 300" and return. The
server crashes.
Tested on:
- oftpd server 0.3.6 on Suse Linux 8.2
Discovered by: Andreas Rueegg and Philippe Oechslin of the Security Bug
Catcher project (http://lasecwww.epfl.ch/philippe.shtml). The security bug
catcher is a tool to automatically find vulnerabilities. We are currently
running tests on scores of FTP servers and notifying vendors when we find
something.
|
|
