[12049] in bugtraq
Re: Fw: Remote bufferoverflow exploit for ftpd from AIX 4.3.2
daemon@ATHENA.MIT.EDU (W.H.J.Pinckaers)
Wed Sep 29 15:28:00 1999
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Message-Id: <1DF26A56012@cpedu1.cpedu.rug.nl>
Date: Wed, 29 Sep 1999 13:00:32 MET
Reply-To: "W.H.J.Pinckaers" <W.H.J.Pinckaers@CPEDU.RUG.NL>
From: "W.H.J.Pinckaers" <W.H.J.Pinckaers@CPEDU.RUG.NL>
X-To: Gerrie <gerrie@hit2000.vuurwerk.nl>,
"sq01@Yorku.Ca" <sq01@Yorku.Ca>, bugtraq@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <098101bf0a03$935d2d00$0401a8c0@master.dokter.multiweb.nl>
sq01@Yorku.Ca <sq01@Yorku.Ca> Wrote
>Hi,
> >
> >Short of disabling ftpd completely, is there a work-around that will not
> >affect our users ?
> >
At this time: NO, but please make sure you are vulnerable first, we
did discover that this bug is very specific for AIX 4.3.2. (Most other
AIX versions aren't vulnerable to this particular bug)
You can check this by running something like:
perl -e 'print "A" x 5000' | nc -v -v aix 21
(effectivly sending a long string to the aix ftpd)
if this returns immediatly (ftpd dies) you are vulnerable if it returns a
lot of 500 AAAAAAA... unknown command or something like that
errors you are NOT vulnerable.
Greetz
dvorak (@synnergy.net // @hit2000.org)
