Date: Mon, 09 Jun 2003 12:19:40 +0900
From: :: Operash :: <[email protected]>
To: [email protected]Subject: [LeapFTP] "PASV" Reply Buffer Overflow Vulnerability
----------------------------------------------------------------------
SUMMARY : [LeapFTP] "PASV" Reply Buffer Overflow Vulnerability
PRODUCT : LeapFTP
VERSIONS : 2.7.3.600
VENDOR : LeapWare (http://www.leapware.com/)
SEVERITY : Critical.
Code Execution.
DISCOVERED BY : nesumin
AUTHOR : :: Operash ::
REPORTED DATE : 2003-05-07
RELEASED DATE : 2003-06-09
----------------------------------------------------------------------
0. PRODUCTS
=============
LeapFTP is a GUI base FTP Client for Windows.
LeapWare (http://www.leapware.com/)
1. DESCRIPTION
================
The buffer overflow occurs on the stack area if the reply that contains
a long string is returned from a server for the "PASV" command request.
By exploiting this vulnerability, an attacker can execute an arbitrary
code on the user's system if the user connects to the malicious server.
With this vulnerability, there could be following risks;
* Infection with Virus or Trojan, etc.
* Destruction of the system.
* Leak or alteration of the local data.
2. SYSTEMS AFFECTED
LeapFTP 2.7.3.600
And previous versions may have same vulnerability.
3. SYSTEMS NOT AFFECTED
LeapFTP 2.7.4.602
4. EXAMINES
=============
Tested versions :
LeapFTP 2.7.3.600
LeapFTP 2.7.4.602
Tested platforms :
Windows 98SE Japanese
Windows 2000 Professional SP3 Japanese
5. VENDOR STATUS
2003-05-21 Vendor released fixed-version (2.7.4.602) and the security
information.
Reference: http://www.leapware.com/security/2003052101.txt
6. SOLUTION
=============
Upgrade to version 2.7.4.602 or later version.
7. TECHNICAL DETAILS
LeapFTP tries to create a connection of data transfer to get
the File List or etc when it connected to a FTP server.
Then, it requests the IP address and port number by using
"PASV" command if PASV-MODE is enabled.
It causes the buffer overflow on the stack area if the server's
reply for this "PASV" request has a long IP address like following.
Example:
---> PASV
<--- 227 (AAAAAAAAAA ..... (over 0x421 bytes) ..... ,1,1,1,1,1)
And this buffer overflow can overwrite a Structured Exception Handler
on the stack area with an arbitrary value by specifying the address
data over 0x421 bytes.
If a Structured Exception Handler is overwritten with the address of
buffer that has an arbitrary code or the address of instruction data
that redirects to there, the processing path moves to that buffer.
Therefore, it is able to execute an arbitrary code as the privilege of
LeapFTP process.
8. SAMPLE CODE
================
None release.
9. TIME TABLE
===============
2003-04-20 Discovered this vulnerability.
2003-05-07 Reported to vendor.
2003-05-08 Received a reply from vendor.
2003-05-14 Received a fixed-version from vendor.
2003-05-15 Conveyed to vendor that the fix has been done.
2003-05-21 Vendor released fixed-version.
2003-06-09 Released this advisory.
10. DISCLAIMER
================
A. We cannot guarantee the accuracy of all statements in this information.
B. We do not anticipate issuing updated versions of this information
unless there is some material change in the facts.
C. And we will take no responsibility for any kinds of disadvantages by
using this information.
D. You can quote this advisory without our permission if you keep the following;
a. Do not distort this advisory's content.
b. A quoted place should be a medium on the Internet.
E. If you have any questions, please contact to us.
* Exception
We strictly forbid 'Secunia' (http://www.secunia.com/) to republish or
redistribute our advisory.
11. CONTACT, ETC
:: Operash ::
imagine (Operash Webmaster)
nesumin <[email protected]>
Thanks to :
melorin
piso(sexy)
