Description
Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string to the (1) USER, (2) PASS, (3) REIN, (4) QUIT, (5) PORT, (6) PASV, (7) TYPE, (8) STRU, (9) MODE, (10) RETR, (11) STOR, (12) APPE, (13) ALLO, (14) REST, (15) RNFR, (16) RNTO, (17) ABOR, (18) DELE, (19) CWD, (20) LIST, (21) NLST, (22) SITE, (23) STST, (24) HELP, (25) NOOP, (26) MKD, (27) RMD, (28) PWD, (29) CDUP, (30) STOU, (31) SNMT, (32) SYST, and (33) XPWD commands.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 4
- KnFTP 1.0 - Remote Buffer Overflow (DEP Bypass) (Metasploit) EDB-18089 · remote · Nov 7, 2011
- KnFTP 1.0.0 Server - 'USER' Remote Buffer Overflow EDB-17870 · remote · Sep 19, 2011 · verified
- KnFTP 1.0.0 Server - Multiple Buffer Overflows (PoC) (SEH) EDB-17856 · dos · Sep 18, 2011 · verified
- KnFTP Server - Remote Buffer Overflow EDB-17819 · remote · Sep 12, 2011 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 45907 third-party-advisory
- 17856 exploit
- 20110902 KnFTPd v1.0.0 Multiple Command Remote Buffer Overflow mailing-list
- 18089 exploit
- knftpd-multiple-commands-bo(69557) vdb-entry
- 75147 vdb-entry
- 17819 exploit
- 17870 exploit