[Full-disclosure] Crob FTP Server remote buffer overflows

[Leon Juranic <ljuranic@xxxxxx>]

                                LSS Security Advisory #LSS-2005-06-06
                                        http://security.lss.hr



 
Title: Crob FTP Server remote buffer overflows
Advisory ID: LSS-2005-06-06
Date: 2005-06-01
Advisory URL: http://security.lss.hr/index.php?page=details&ID=LSS-2005-06-06
Impact: Remote code execution
Risk Level: High
Vulnerability Type: Remote
Vendors Status: 7th March, 2005


 
==[ Overview
 
Crob FTP Server is a powerful and flexible FTP Server with full user management 
and network control for Windows 95/98/ME/2000/XP/2003. Crob FTP Server is using
the standard FTP (File Transfer Protocol) protocol an can be downloaded from
http://www.crob.net/en/.
 


==[ Vulnerability

There are various buffer overflows in Crob FTP server when processing client 
input.
First vulnerability is the stack overflow that can be triggered with a very 
long 
parameter supplied to arbitrary FTP command (i.e. STOR) and calling RMD command
with long parameter afterwards. As a result, EIP is overflowed with user input.
Second vulnerability is the heap overflow vulnerability, probably in globbing
code, which can be triggered with characters like '?' or '*' followed by a long
string. This vulnerability can be triggered with commands like LIST or NLST. 
Sucessful exploitation of these vulnerabilities will lead to remote code 
execution.


 
==[ Affected Version

Vulnerabilities were discovered in the latest Crob FTP server 3.6.1, but the
older versions might be also vulnerable.


 
==[ Fix

No fix available yet.


 
==[ PoC Exploit
 
Proof of concept code can be downloaded at http://security.lss.hr/PoC


 
==[ Credits
 
Credits for this vulnerability goes to Leon Juranic <ljuranic@xxxxxx>.


 
==[ LSS Security Contact
 
LSS Security Team, 

WWW : http://security.lss.hr
E-mail : security@xxxxxx
Tel : +385 1 6129 775 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/