HPUX FTPd vulnerability

[Przemyslaw Frasunek <venglin () FREEBSD LUBLIN PL>]

Hello,

I have discovered HPUX ftpd remote vulnerability. The problem persists
in using vsprintf() without format string. Example:

220 xxx FTP server (Version 1.7.212.2 Tue Apr 21 12:14:46 GMT 1998) ready.
user ftp
331 Guest login ok, send ident as password.
pass %.1030d
230 Guest login ok, access restrictions apply.
Connection closed by foreign host.

Ftpd segfaulted here. Let's try with smaller value:

220 xxx FTP server (Version 1.7.212.2 Tue Apr 21 12:14:46 GMT 1998) ready.
user ftp
331 Guest login ok, send ident as password.
pass %.1024d
230 Guest login ok, access restrictions apply.
quit
221 Goodbye.
Connection closed by foreign host.

It works now. So, password buffer is 1024 bytes long. No problem with
exploiting this, by sending such format string:

<shellcode>%.<len>d<ret>

I have almost working exploit, but don't want to post it, until patches
will be available. HP Security Team is notified.

--
* Fido: 2:480/124 ** WWW: http://www.freebsd.lublin.pl ** NIC-HDL: PMF9-RIPE *
* Inet: venglin () freebsd lublin pl ** PGP: D48684904685DF43  EA93AFA13BE170BF *