|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Subject: HPUX FTPd vulnerability
From: Przemyslaw Frasunek (venglin
FREEBSD.LUBLIN.PL)Date: Sun Aug 06 2000 - 12:18:12 CDT
- Next message: Chris Evans: "Re: kon2"
- Previous message: You, Jin-Ho: "Diskcheck 3.1.1 Symlink Vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Hello,
I have discovered HPUX ftpd remote vulnerability. The problem persists
in using vsprintf() without format string. Example:
220 xxx FTP server (Version 1.7.212.2 Tue Apr 21 12:14:46 GMT 1998) ready.
user ftp
331 Guest login ok, send ident as password.
pass %.1030d
230 Guest login ok, access restrictions apply.
Connection closed by foreign host.
Ftpd segfaulted here. Let's try with smaller value:
220 xxx FTP server (Version 1.7.212.2 Tue Apr 21 12:14:46 GMT 1998) ready.
user ftp
331 Guest login ok, send ident as password.
pass %.1024d
230 Guest login ok, access restrictions apply.
quit
221 Goodbye.
Connection closed by foreign host.
It works now. So, password buffer is 1024 bytes long. No problem with
exploiting this, by sending such format string:
<shellcode>%.<len>d<ret>
I have almost working exploit, but don't want to post it, until patches
will be available. HP Security Team is notified.
-- * Fido: 2:480/124 ** WWW: http://www.freebsd.lublin.pl ** NIC-HDL: PMF9-RIPE * * Inet: venglin
- Next message: Chris Evans: "Re: kon2"
- Previous message: You, Jin-Ho: "Diskcheck 3.1.1 Symlink Vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]