Buffer Overflow sailaja yagnavajhala sailaja yagnavajhala

When we try to write a value to a buffer which occupies more memory than it is actually assigned When we try to write a value to a buffer which occupies more memory than it is actually assigned Attckers uses this to write shell code to get privilages and change current execution path of the server. Attckers uses this to write shell code to get privilages and change current execution path of the server. Occurs when boundary values are not checked when copying a value to stack Occurs when boundary values are not checked when copying a value to stack

Used platforms and softwares Windows XP operating system Windows XP operating system FTP Serv-U4.1 version FTP Serv-U4.1 version Gentoo Linux operating system Gentoo Linux operating system Ethereal version Ethereal version

Start the server

Start running the program on attackers computer as shown bellow at the prompt

After the attcker gets command prompt she can get full aceess rights to the server and the server stops as soon as it gets attcked

As the code executes cmd.exe file at the server the administrator can stop further access by killing that process.

Ethereal trace showing the MDTM command request Ethereal trace showing the MDTM command request

Follow the TCP stream

This attack can be done on FTP serv-U 3.x,4.x,5.0. This attack can be done on FTP serv-U 3.x,4.x,5.0. Currently there are no patches available for this vulnerability Currently there are no patches available for this vulnerability

Countermeasures Don’t use functions which doesn’t check boundary values Don’t use functions which doesn’t check boundary values Invalidating instructions execution by stack Invalidating instructions execution by stack Using efficient tools which would warn incase of inefficient function usage or when there is a change of return address being performed Using efficient tools which would warn incase of inefficient function usage or when there is a change of return address being performed