Malformed vsprintf in BFTPd allows execution of arbitrary code
7 Dec. 2000
Summary
BFTPd is a Linux FTP server with chroot and setreuid functionality. The latest version of BFTP has a potential security problem when the NSLT command is requested to list a file that contains a formatting string. The vulnerability allows remote attackers to overflow internal buffers, and execute arbitrary code.
Credit:
The information has been provided by asynchro.
There is a malformed call to vsprintf in BFTPd. The relevant vulnerable function is sendstrf:
int sendstrf(int s, char *format, ...) {
....
vsprintf(buffer, format, val);
When the function is called from an NLIST command, it is incorrectly allowed to supply formatting string to the vsprintf:
else
foo = 1;
sendstrf(s, entry->d_name);
}
This can be used to overflow the buffer of the vsprintf and execute arbitrary code.
Exploit:
/*
Creates a filname to exploit the bug in bftpd 1.0.12
Create the file, cwd in the shell directory and nlist the file directory
(sh is executed in the working dir because it is not possible to insert a / in
the filename)
