File ftp-vuln-cve2010-4221

脚本使用类型: portrule
脚本所属分类: intrusive, vuln
脚本下载地址: http://nmap.org/svn/scripts/ftp-vuln-cve2010-4221.nse

User Summary

Checks for a stack-based buffer overflow in the ProFTPD server, version between 1.3.2rc3 and 1.3.3b. By sending a large number of TELNET_IAC escape sequence, the proftpd process miscalculates the buffer length, and a remote attacker will be able to corrupt the stack and execute arbitrary code within the context of the proftpd process (CVE-2010-4221). Authentication is not required to exploit this vulnerability.

Reference:

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4221
• http://www.exploit-db.com/exploits/15449/
• http://www.metasploit.com/modules/exploit/freebsd/ftp/proftp_telnet_iac

Script Arguments

vulns.showall

Example Usage

执行格式

nmap --script ftp-vuln-cve2010-4221 -p 21 <host>

Script Output

PORT   STATE SERVICE
21/tcp open  ftp
| ftp-vuln-cve2010-4221: 
|   VULNERABLE:
|   ProFTPD server TELNET IAC stack overflow
|     State: VULNERABLE
|     IDs:  CVE:CVE-2010-4221  BID:44562  OSVDB:68985
|     Risk factor: High  CVSSv2: 10.0 (HIGH) (AV:N/AC:L/Au:N/C:C/I:C/A:C)
|     Description:
|       ProFTPD server (version 1.3.2rc3 through 1.3.3b) is vulnerable to
|       stack-based buffer overflow. By sending a large number of TELNET_IAC
|       escape sequence, a remote attacker will be able to corrup the stack and
|       execute arbitrary code.
|     Disclosure date: 2010-11-02
|     References:
|       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4221
|       http://osvdb.org/68985
|       http://www.metasploit.com/modules/exploit/freebsd/ftp/proftp_telnet_iac
|       http://bugs.proftpd.org/show_bug.cgi?id=3521
|_      http://www.securityfocus.com/bid/44562

Requires

• ftp
• shortport
• stdnse
• string
• vulns

Author: Djalal Harouni

License: VER007 整理 http://www.ver007.com