Удаленный root в proftpd

Дырка похожая на аналогичную в WU, связана с использованием ввода пользователя в качестве форматной строки...

ftpd: the advisory version

You might have seen the wuftpd exploit by tf8, he released it in his own lame way. But now I bring you the story behind it. The story begins inside the ftpcmd.y file. Which has the ftp commands in it. The bug is in the siteexecchar cmd function. There is calls lreply200,cmd; In ftpd.c we find voi...

CVE-1999-0911

CVE-1999-0911 affects ProFTPD, wu-ftpd, and beroftpd. The vulnerability is a buffer overflow triggered by a sequence of MKD/CWD commands that create nested directories, allowing remote attackers to gain root privileges. Connected docs mention ProFTPD-related overflows (e.g., in 1.2.0pre4/pre6 var...

CVE-1999-0911

Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories...

CVE-1999-0911: Undefined Security Weakness

Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories...

proftpd.mod_sqlpw.txt

A member of the proftpd mailing list and myself discovered a problem with proftpd with modsqlpw.c optional module compiled in. Unix last command reveals passwords where the username should be. A patch was sent to the mailing list, however, the patch only protects ftp localhost not ftp remotehost...

CVE-1999-1475

ProFTPd 1.2 compiled with the modsqlpw module records user passwords in the wtmp log file, which allows local users to obtain the passwords and gain privileges by reading wtmp, e.g. via the last command...

[SECURITY] New version of proftpd fixes remote exploits

The proftpd version that was distributed in Debian GNU/Linux 2.1 had several buffer overruns that could be exploited by remote attackers. A short list of problems: user input was used in snprintf without sufficient checks there was an overflow in the logxfer routine you could overflow a buffer by...

[SECURITY] New version of proftpd fixes remote exploits

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman November 11, 1999 - ------------------------------------------------------------------------ The proftpd version that was...

CVE-1999-0368

The CVE-1999-0368 issue involves buffer overflows in wuarchive ftpd (wu-ftpd) and ProFTPD that can lead to remote root access (palmetto). Red Hat’s entry reiterates the same vulnerability. Nessus plugin 10318 (WU-FTPD Multiple Vulnerabilities) and 10318’s description cite the overflow as enabling...

CVE-1999-0368

Buffer overflows in wuarchive ftpd wu-ftpd and ProFTPD lead to remote root access, a.k.a. palmetto...

CVE-1999-0368: Undefined Security Weakness

Buffer overflows in wuarchive ftpd wu-ftpd and ProFTPD lead to remote root access, a.k.a. palmetto...

SDI.exploit4.proftpd.txt

From: Bugtraq List [email protected] on behalf of Thiago/c0nd0r [email protected] Sent: Wednesday, September 15, 1999 12:31 PM To: [email protected] Subject: SDI anonymous remote exploit for proftpd Hello, I've seen some discussion about the possibility of exploit the newest proft...

proftpd.1.2.0pre6.txt

Tymm Twillman [email protected] Sent: Friday, September 17, 1999 2:15 PM Subject: proftpd 1.2.0pre6 patch Before I release the exploit, I'd like to give people a chance to fix the problem. Here's the patch. Note that there are other potential problems; I've been in contact with MacGyver and a...

proftpd_exploiting_toolkit.txt

Subject: proftpd To: [email protected] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 / babcia padlina ltd. poland, 17/08/99 your ultimate proftpd pre0-3 exploiting toolkit based on: - adm-wuftpd by duke - kombajn do czere¶ni by Lam3rZ thx for shellcode! thx and greetz. / include include...

proftpd_exploit.txt

Subject: ProFTPD To: [email protected] / !!!! Private .. ... distribute !!!! proftpd-1.2.0 remote root exploit beta2 Still need some code, but it works fine Offset: Linux Redhat 6.0 0 - proftpd-1.2.0pre1 0 - proftpd-1.2.0pre2 0 - proftpd-1.2.0pre3 If this dont work, try changing the align...

ProFTPD NLST Command Argument Handling Remote Overflow

It was possible to crash the remote FTP server by issuing a specially crafted command, such as 'NLST aaaXXXX%u%...%u%u%u%%u%653300u%n' where 'XXXX' is replaced with four characters - ASCII values 0xDC, 0x4F, 0x07 and 0x08. This issue is known to affect ProFTPD version 1.2.0pre6, although other FT...

proftpd_exploit.txt

Subject: SDI anonymous remote exploit for proftpd To: [email protected] Hello, I've seen some discussion about the possibility of exploit the newest proftpd vulnerability without having the permission to write STOR. Here is the proof. Unlikely the last published exploit, this one does not...

FreeBSD_FTP_port_holes.txt

Subject: [email protected]: FreeBSD Security Advisory: FreeBSD-SA-99:03.ftpd REISSUED To: [email protected] [email protected] 2.ems Content-Type: text/plain; charset=us-ascii PGP Signature Status: unknown Signer: Unknown, Key ID xBE7497F1 Signed: 9/15/99 11:30:30 PM...

ProFTPd 1.2 pre6 - snprintf Remote Root

ProFTPd 1.2 pre6 - snprintf Remote Root source: https://www.securityfocus.com/bid/650/info Lack of user input validation in ProFTPD can lead to a remote root vulnerability. On systems that support it ProFTPD will attempt to modify the name of the program being executed argv0 to display the comman...