[SIG^2 G-TEC] SurgeFTP LEAK Command Denial-Of-Service Vulnerability

[<chewkeong () security org sg>]

SIG^2 Vulnerability Research Advisory

SurgeFTP LEAK Command Denial-Of-Service Vulnerability

by Tan Chew Keong
Release Date: 07 Apr 2005


ADVISORY URL
http://www.security.org.sg/vuln/surgeftp22m1.html


SUMMARY

SurgeFTP (http://netwinsite.com/surgeftp/) is an FTP server with SSL/TLS security, easy management and cross platform 
support. It is available for Windows, Solaris and Linux. A denial-of-service vulnerability was found in SurgeFTP, which 
may be exploited to crash the server or to prevent it from correctly serving files.
 
 
TESTED SYSTEM

SurgeFTP Version 2.2m1 and 2.2k3 Windows on English Win2K SP4, WinXP SP2.

 
DETAILS

SurgeFTP is an FTP server with SSL/TLS security, easy management and cross platform support. It is available for 
Windows, Solaris and Linux. A denial-of-service vulnerability was found in SurgeFTP, which may be exploited to crash 
the server or to prevent it from correctly serving files.

SurgeFTP responds to a non-standard FTP command, LEAK. It is postulated that this command may have been intended to be 
used to test the server's response to file handle leakages. Upon receiving the LEAK command, SurgeFTP will call the 
cmd_leak() function. cmd_leak() will in turn call the mgr_cmd_openmore() function. mgr_cmd_openmore() will open the 
file "a.a_write" 925 times, thus potentially causing the process to run out of file handles. 

Subsequently, the main thread will call the detect_imobilizing_bug() function. This function will try to open 9 test 
files. i.e. testfile.0, testfile.1, ..., testfile.9. If the LEAK command has been issued before, this function will be 
unable to open any of the 9 test files.  This causes a code branch to be taken that will cause a write exception.

This LEAK command can be sent prior to authentication. i.e. it can be sent immediately after connecting to the FTP 
server. On a Win2K system, this will cause SurgeFTP to stop receiving any connections until the service is 
automatically restarted by the SC Manager. On a WinXP system, SurgeFTP will continue to accept FTP connections, but 
will be unable to send or receive any files. Logging of FTP commands to cmds.log will also fail until the server is 
automatically restarted.


PATCH

Upgrade to version 2.2m2.

 
DISCLOSURE TIMELINE

03 Apr 05 - Vulnerability Discovered.
05 Apr 05 - Initial Vendor Notification.
06 Apr 05 - Vendor Released Fixed Version.
07 Apr 05 - Public Release.


GREETINGS

All guys at SIG^2 G-TEC Lab
http://www.security.org.sg/webdocs/g-tec.html 

"IT Security...the Gathering. By enthusiasts for enthusiasts."