<<< Date Index >>>     <<< Thread Index >>>

[SIG^2 G-TEC] SurgeFTP LEAK Command Denial-Of-Service Vulnerability




SIG^2 Vulnerability Research Advisory

SurgeFTP LEAK Command Denial-Of-Service Vulnerability

by Tan Chew Keong
Release Date: 07 Apr 2005


ADVISORY URL
http://www.security.org.sg/vuln/surgeftp22m1.html


SUMMARY

SurgeFTP (http://netwinsite.com/surgeftp/) is an FTP server with SSL/TLS 
security, easy management and cross platform support. It is available for 
Windows, Solaris and Linux. A denial-of-service vulnerability was found in 
SurgeFTP, which may be exploited to crash the server or to prevent it from 
correctly serving files.
 
 
TESTED SYSTEM

SurgeFTP Version 2.2m1 and 2.2k3 Windows on English Win2K SP4, WinXP SP2.

 
DETAILS

SurgeFTP is an FTP server with SSL/TLS security, easy management and cross 
platform support. It is available for Windows, Solaris and Linux. A 
denial-of-service vulnerability was found in SurgeFTP, which may be exploited 
to crash the server or to prevent it from correctly serving files.

SurgeFTP responds to a non-standard FTP command, LEAK. It is postulated that 
this command may have been intended to be used to test the server's response to 
file handle leakages. Upon receiving the LEAK command, SurgeFTP will call the 
cmd_leak() function. cmd_leak() will in turn call the mgr_cmd_openmore() 
function. mgr_cmd_openmore() will open the file "a.a_write" 925 times, thus 
potentially causing the process to run out of file handles. 

Subsequently, the main thread will call the detect_imobilizing_bug() function. 
This function will try to open 9 test files. i.e. testfile.0, testfile.1, ..., 
testfile.9. If the LEAK command has been issued before, this function will be 
unable to open any of the 9 test files.  This causes a code branch to be taken 
that will cause a write exception.

This LEAK command can be sent prior to authentication. i.e. it can be sent 
immediately after connecting to the FTP server. On a Win2K system, this will 
cause SurgeFTP to stop receiving any connections until the service is 
automatically restarted by the SC Manager. On a WinXP system, SurgeFTP will 
continue to accept FTP connections, but will be unable to send or receive any 
files. Logging of FTP commands to cmds.log will also fail until the server is 
automatically restarted.


PATCH

Upgrade to version 2.2m2.

 
DISCLOSURE TIMELINE

03 Apr 05 - Vulnerability Discovered.
05 Apr 05 - Initial Vendor Notification.
06 Apr 05 - Vendor Released Fixed Version.
07 Apr 05 - Public Release.


GREETINGS

All guys at SIG^2 G-TEC Lab
http://www.security.org.sg/webdocs/g-tec.html 

"IT Security...the Gathering. By enthusiasts for enthusiasts."