Published: 22/10/2004 Updated: 11/07/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 550

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Buffer overflow in Ability Server 2.34, and possibly other versions, allows remote malicious users to execute arbitrary code via a long STOR command.

Vulnerable Product	Search on Vulmon	Subscribe to Product
code-crafters ability server 2.2.5
code-crafters ability server 2.3.2
code-crafters ability server 2.3.4

/* no@0x00:~/Exploits/abilityftp$ /ability-exploit **Ability Server 234 Remote buffer overflow exploit in ftp STOR by NoPh0BiA** [x] Launching listener [x] Bind successfull [x] Listening on port 31337 [x] Connected to: 19216801 [x] Sending bad codedone [x] Waiting for shell [x] Got connection from 19216801 [x] 0wn3d! Microsoft W ...

################################### # Ability Server 234 FTP STOR Buffer Overflow # # Advanced, secure and easy to use FTP Server # # 21 Oct 2004 - muts # ################################### # D:\BO>ability-234-ftp-storpy # ################################### # D:\data\tools>nc ...

This module exploits a stack-based buffer overflow in Ability Server 2.34. Ability Server fails to check input size when parsing 'STOR' and 'APPE' commands, which leads to a stack based buffer overflow. This plugin uses the 'STOR' command. The vulnerability has been confirmed on version 2.34 and has also been reported in version 2.25 and 2.32. Other versions may also be affected.

msf > use exploit/windows/ftp/ability_server_stor
      msf exploit(ability_server_stor) > show targets
            ...targets...
      msf exploit(ability_server_stor) > set TARGET <target-id>
      msf exploit(ability_server_stor) > show options
            ...show and set options...
      msf exploit(ability_server_stor) > exploit

NVD-CWE-Other http://www.kb.cert.org/vuls/id/857846 http://www.securityfocus.com/bid/11508 http://www.osvdb.org/11030 http://secunia.com/advisories/12941 http://marc.info/?l=bugtraq&m=109850947508816&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/17823 https://nvd.nist.gov https://www.exploit-db.com/exploits/618/https://www.rapid7.com/db/modules/exploit/windows/ftp/ability_server_stor

CVE-2004-1626

Vulnerability Summary

Most Upvoted Vulmon Research Post

Exploits

Metasploit Modules

References

Vulmon Search

About

Products

Connect