robinbhandari FTP Remote Denial Of Service

2019.03.13
Credit: x90c
Risk: Medium
Local: No
Remote: Yes
CWE: N/A

Title: CVE-2019-9668 robinbhandari FTP remote DoS vulnerability Vulnerable: - https://github.com/rovinbhandari/FTP Description: robinbhandari is a open source tiny ftp server/client in github.com. it has a remote DoS vulnerability in a 'put' command. Timeline: 2019-03-11 CVE-2019-9668 robinbhandari FTP remote DoS vulnerability. 2019-03-10 my personal site advisory published. 2019-03-09 request CVE to mitre. (Report). 2019-02-27 vulnerability found. Details: hacker can set packet struct's datalen field variable. which is recv size from server side file transferring. then If set 0xffff(size of unsigned short) to datalen, put ./file then server side error occured and server will be closed. Vulnerable code: -------------------- FTP/file_transfer_functions.c [...] void receive_file(struct packet* hp, struct packet* data, int sfd, FILE* f) { [...] int x; int i = 0, j = 0; // (1) recved packet from ftp client. if((x = recv(sfd, data, size_packet, 0)) <= 0) er("recv()", x); j++; // (2) hp = struct packet * fields parsing. hp = ntohp(data); //printpacket(hp, HP); while(hp->type == DATA) // (3) If DATA type then enter here.. { i += fwrite(hp->buffer, 1, hp->datalen, f); // (4) x90c:: hacker can set hp->datalen, then server daemon error then remote DoS result occured. if((x = recv(sfd, data, size_packet, 0)) <= 0) er("recv()", x); j++; hp = ntohp(data); //printpacket(hp, HP); } [...] -------------------- PoC: we can change client_ftp.c to compile. Credit: x90c <x90chacker@gmail.com> - http://www.x90chacker.org.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top