vendor:
Serv-U FTPD
by:
spoonm
7.5
CVSS
HIGH
Buffer Overflow
Buffer Overflow
CWE
Product Name: Serv-U FTPD
Affected Version From: Version 3
Affected Version To: Version 5.0.0.4
Patch Exists: NO
Related CWE: CVE-2004-0330
CPE: CPE-None
Platforms Tested: Windows
2010
Serv-U FTPD MDTM Overflow
This is an exploit for the Serv-U's MDTM command timezone overflow. It has been heavily tested against versions 4.0.0.4/4.1.0.0/4.1.0.3/5.0.0.0 with success against nt4/2k/xp/2k3. I have also had success against version 3, but only tested 1 version/os. The bug is in all versions prior to 5.0.0.4, but this exploit will not work against versions not listed above. You only get one shot, but it should be OS/SP independent. This exploit is a single hit, the service dies after the shellcode finishes execution.
Mitigation:
Upgrade to version 5.0.0.4 or later