CVE-2010-3972
published 2010-12-23CVE-2010-3972: Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information…
PriorityP268critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
94.53%
99.8th percentile
Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) 7.0, and IIS 7.5, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted FTP command, aka "IIS FTP Service Heap Buffer Overrun Vulnerability." NOTE: some of these details are obtained from third party information.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
0xff (Telnet IAC byte) repeated in FTP command payload
- →Detect large FTP requests containing dense repetitions of Telnet IAC byte (0xff) sequences sent pre-authentication; the PoC payload consists almost entirely of repeating \xef\x83\xb0 sequences (UTF-8 encoded) and terminal \xff bytes targeting the IIS FTP heap buffer. ↗
- →The exploit is pre-authentication, so anomalous large FTP control-channel payloads containing 0xff bytes before any USER command should be flagged on port 21 against IIS 7.0/7.5 FTP servers. ↗
- →Monitor for crashes or unexpected restarts of the IIS FTP service process (ftpsvc.dll) following receipt of oversized FTP commands, as the overflow causes a daemon crash. ↗
- ·The Metasploit module is classified as an auxiliary/dos module, meaning it is confirmed to trigger a crash; RCE exploitation reliability is unconfirmed from the sources. ↗
- ·Affected components are specifically Microsoft FTP Service 7.0 and 7.5 running under IIS 7.0 and IIS 7.5; the vulnerability resides in ftpsvc.dll, not in the core IIS HTTP stack. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft IIS 7.5 (Windows 7) - FTPSVC Unauthorized Remote Denial of Service (PoC)
exploitdb·2010-12-21
CVE-2010-3972 Microsoft IIS 7.5 (Windows 7) - FTPSVC Unauthorized Remote Denial of Service (PoC)
Microsoft IIS 7.5 (Windows 7) - FTPSVC Unauthorized Remote Denial of Service (PoC)
---
import socket, sys
print "\n"
print "----------------------------------------------------------------"
print "| Windows 7 IIS7.5 FTPSVC UNAUTH'D REMOTE DOS POC |"
print "| Matthew Bergin, Bergin Penetration Testing |"
print "| Win7 Ultimate v6.1 build 7600, IIS 7.5.7600.16385 |"
print "----------------------------------------------------------------"
print "\n"
buf=("\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef"
"\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83"
"\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0"
"\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef"
"\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83\xb0\xef\x83"
"\xb0\
Metasploit
Microsoft IIS FTP Server Encoded Response Overflow Trigger
metasploit
Microsoft IIS FTP Server Encoded Response Overflow Trigger
Microsoft IIS FTP Server Encoded Response Overflow Trigger
This module triggers a heap overflow when processing a specially crafted FTP request containing Telnet IAC (0xff) bytes. When constructing the response, the Microsoft IIS FTP Service overflows the heap buffer with 0xff bytes. This issue can be triggered pre-auth and may in fact be exploitable for remote code execution.
No writeups or analysis indexed.
http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspxhttp://secunia.com/advisories/42713http://www.exploit-db.com/exploits/15803http://www.kb.cert.org/vuls/id/842372http://www.securityfocus.com/bid/45542http://www.securitytracker.com/id?1024921http://www.vupen.com/english/advisories/2010/3305https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-004https://exchange.xforce.ibmcloud.com/vulnerabilities/64248https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12370http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspxhttp://secunia.com/advisories/42713http://www.exploit-db.com/exploits/15803http://www.kb.cert.org/vuls/id/842372http://www.securityfocus.com/bid/45542http://www.securitytracker.com/id?1024921http://www.vupen.com/english/advisories/2010/3305https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-004https://exchange.xforce.ibmcloud.com/vulnerabilities/64248https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12370
2010-12-23
Published