|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 3704 CVE : CVE-2008-1052 SecurityRisk : Medium  (About) Remote Exploit : Yes Local Exploit : No Exploit Given : Yes Credit : Luigi Auriemma Published : 27.02.2008
Advisory Text : ####################################################################### Luigi Auriemma Application: SurgeFTP http://www.netwinsite.com/surgeftp/ Versions: <= 2.3a2 Platforms: Windows, Linux and Solaris Bug: NULL pointer access Exploitation: remote Date: 25 Feb 2008 Author: Luigi Auriemma e-mail: aluigi (at) autistici (dot) org [email concealed] web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== SurgeFTP is a commercial FTP server which supports also SSL/TLS and has a web interface for remote administration. ####################################################################### ====== 2) Bug ====== When a Content-Length parameter is received from the client, SurgeFTP tries to allocate the amount of memory (max 2147483647 bytes) specified in this field and then copies the data in the resulted new buffer. The problem is in the lack of checks on the result of the allocation which leads to the crash of the entire server during the copying of the data to a NULL pointer if that amount of memory cannot be allocated. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/surgeftpizza.txt nc SERVER 7021 -v -v < surgeftpizza.txt ####################################################################### ====== 4) Fix ====== No fix ####################################################################### --- Luigi Auriemma http://aluigi.org  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
Multiple Vendors libc/gdtoa printf(3) Array Overrun
SecurityReason realised new advisory about vulnerabilities libc/gdtoa... |
||
| Apache |  |
|
» Apache Tomcat |
||
» Apache Tomcat User |
||
| PHP | |
|
» PHP |
||
- 2009-05-30| Copyright © SecurityReason.com. All Rights Reserved. |