[LeapFTP] "PASV" Reply Buffer Overflow Vulnerability

[":: Operash ::" <nesumin () softhome net>]

----------------------------------------------------------------------
SUMMARY        : [LeapFTP] "PASV" Reply Buffer Overflow Vulnerability
PRODUCT        : LeapFTP
VERSIONS       : 2.7.3.600
VENDOR         : LeapWare (http://www.leapware.com/)
SEVERITY       : Critical.
                 Code Execution.
DISCOVERED BY  : nesumin
AUTHOR         : :: Operash ::
REPORTED DATE  : 2003-05-07
RELEASED DATE  : 2003-06-09
----------------------------------------------------------------------

0. PRODUCTS
=============

  LeapFTP is a GUI base FTP Client for Windows.
  LeapWare (http://www.leapware.com/)


1. DESCRIPTION
================

  The buffer overflow occurs on the stack area if the reply that contains
  a long string is returned from a server for the "PASV" command request.
  By exploiting this vulnerability, an attacker can execute an arbitrary
  code on the user's system if the user connects to the malicious server.

  With this vulnerability, there could be following risks;

  * Infection with Virus or Trojan, etc.
  * Destruction of the system.
  * Leak or alteration of the local data.


2. SYSTEMS AFFECTED
=====================

  LeapFTP 2.7.3.600

  And previous versions may have same vulnerability.


3. SYSTEMS NOT AFFECTED
=========================

  LeapFTP 2.7.4.602


4. EXAMINES
=============

  Tested versions :
    LeapFTP 2.7.3.600
    LeapFTP 2.7.4.602

  Tested platforms :
    Windows 98SE Japanese
    Windows 2000 Professional SP3 Japanese


5. VENDOR STATUS
==================

  2003-05-21 Vendor released fixed-version (2.7.4.602) and the security
             information.
             Reference: http://www.leapware.com/security/2003052101.txt


6. SOLUTION
=============

  Upgrade to version 2.7.4.602 or later version.


7. TECHNICAL DETAILS
======================

  LeapFTP tries to create a connection of data transfer to get
  the File List or etc when it connected to a FTP server.
  Then, it requests the IP address and port number by using
  "PASV" command if PASV-MODE is enabled.
  It causes the buffer overflow on the stack area if the server's
  reply for this "PASV" request has a long IP address like following.

  Example:

    ---> PASV
    <--- 227 (AAAAAAAAAA ..... (over 0x421 bytes) ..... ,1,1,1,1,1)

  And this buffer overflow can overwrite a Structured Exception Handler
  on the stack area with an arbitrary value by specifying the address
  data over 0x421 bytes.
  If a Structured Exception Handler is overwritten with the address of
  buffer that has an arbitrary code or the address of instruction data
  that redirects to there, the processing path moves to that buffer.

  Therefore, it is able to execute an arbitrary code as the privilege of
  LeapFTP process.


8. SAMPLE CODE
================

  None release.


9. TIME TABLE
===============

  2003-04-20  Discovered this vulnerability.
  2003-05-07  Reported to vendor.
  2003-05-08  Received a reply from vendor.
  2003-05-14  Received a fixed-version from vendor.
  2003-05-15  Conveyed to vendor that the fix has been done.
  2003-05-21  Vendor released fixed-version.
  2003-06-09  Released this advisory.


10. DISCLAIMER
================

  A. We cannot guarantee the accuracy of all statements in this information.
  B. We do not anticipate issuing updated versions of this information
     unless there is some material change in the facts.
  C. And we will take no responsibility for any kinds of disadvantages by
     using this information.
  D. You can quote this advisory without our permission if you keep the following;
     a. Do not distort this advisory's content.
     b. A quoted place should be a medium on the Internet.
  E. If you have any questions, please contact to us.


  * Exception

     We strictly forbid 'Secunia' (http://www.secunia.com/) to republish or
     redistribute our advisory.


11. CONTACT, ETC
==================

  :: Operash ::

  imagine (Operash Webmaster)
  nesumin <nesumin () softhome net>

  Thanks to :

    melorin
    piso(sexy)