Think of the buffers! Won't somebody think of the buffers?!

["Hugh Mann" <hughmann () hotmail com>]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Advisory Name: Think of the buffers! Won't somebody think of the buffers?!
Impact       : Arbitrary code execution as SYSTEM
Discovered by: Hugh Mann hughmann () hotmail com
Tested progs : Ipswitch WS_FTP Server 4.0.2.EVAL
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Description
~~~~~~~~~~~
A remote user who has write access to a directory can execute arbitrary code 
due to a buffer overflow in WS_FTP Server's STAT command when downloading a 
file the user created. This is difficult to exploit since the username would 
have to be pretty long. If the user has more privilege and can change its 
username it's easily exploited.

Details
~~~~~~~
There are four types of user privileges. In order of user with highest 
privilege:

1. FTP System Administrator users (can change everything)
2. FTP Host Administrator users (can change everyhing on his/her FTP host)
3. Users
4. Anonymous users

Only (1) and (2) can change a user's name. (3) would most likely have to ask 
(1) or (2) to change the username to a much longer name to exploit this, but 
if the FTP host name is really long it may not be necessary. So to be 100% 
sure we can exploit this, the user must be (2) because (2) can add users and 
change their names. A remote (1) can already execute arbitrary files.

A FTP host administrator must log in with the XAUT FTP command or he/she 
won't be able to use any useful SITE commands. Apparently Ipswitch thinks 
the "encrypted" XAUT string is much safer than plaintext USER/PASS.

The stack-based buffer overflow occurs whenever the user uploads/downloads a 
file and at the same time sends a STAT command (no options). The WS_FTP 
Server sends a 211 reply with the status of the download. This string 
contains the FTP host name, IP address, username, filename, and number of 
bytes sent/left. This is a long string (more than 200 unformatted bytes) 
which, with any filename and possibly a long FTP hostname / username, can 
overflow a 512-byte buffer on the stack. "filename" is exactly the same 
filename string the user asked the FTP server to send. The filename contains 
the shellcode and can be max 256 characters long.

Exploit
~~~~~~~
See the attached source code.

_________________________________________________________________
Find a broadband plan that fits. Great local deals on high-speed Internet 
access. http://click.atdmt.com/AVE/go/onm00200360ave/direct/01/

Attachment: xp_ws_ftp_server.zip
Description: