Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:19286
HistoryFeb 27, 2008 - 12:00 a.m.

NULL pointer in SurgeFTP 2.3a2

2008-02-2700:00:00
vulners.com
19

#######################################################################

                         Luigi Auriemma

Application: SurgeFTP
http://www.netwinsite.com/surgeftp/
Versions: <= 2.3a2
Platforms: Windows, Linux and Solaris
Bug: NULL pointer access
Exploitation: remote
Date: 25 Feb 2008
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction

SurgeFTP is a commercial FTP server which supports also SSL/TLS and has
a web interface for remote administration.

#######################################################################

======
2) Bug

When a Content-Length parameter is received from the client, SurgeFTP
tries to allocate the amount of memory (max 2147483647 bytes) specified
in this field and then copies the data in the resulted new buffer.
The problem is in the lack of checks on the result of the allocation
which leads to the crash of the entire server during the copying of the
data to a NULL pointer if that amount of memory cannot be allocated.

#######################################################################

===========
3) The Code

http://aluigi.org/poc/surgeftpizza.txt

nc SERVER 7021 -v -v < surgeftpizza.txt

#######################################################################

======
4) Fix

No fix

#######################################################################


Luigi Auriemma
http://aluigi.org