War FTP Daemon security vulnerability (60 connections & USER)
17 Dec. 1999
Summary
It is possible to cause WarFTP Daemon to crash and possibly execute arbitrary code by opening multiple simultaneous connections to the War FTP server and dumping a buffer into the logon buffer.
Credit:
The information has been provided by: Ussr Labs.
Vulnerable system:
War FTP version 1.70 beta 1 sub-release 4
War FTP version 1.70
War FTP version 1.66
Some hosts only lock-up and do not crash, and in that case the logs will show something like:
I 12/17/99 02:19:43 FTPD:test21:0001 (User=18446744073709551615 ) [WarFTPD::OnAccept()] Client (193.91.161.151:4496->193.91.161.20:21) is connected to the FTP server.
I 12/17/99 02:19:43 FTPD:test21:0002 (User=18446744073709551615 ) [WarFTPD::OnAccept()] Client (193.91.161.151:4497->193.91.161.20:21) is connected to the FTP server.
I 12/17/99 02:19:43 FTPD:test21:0003 (User=18446744073709551615 ) [WarFTPD::OnAccept()] Client (193.91.161.151:4498->193.91.161.20:21) is connected to the FTP server.
This enables you to track down the person who initiated the DoS attack.
