Title: 3Com 3CDaemon Multiple Remote Vulnerabilities
Severity: HIGH
Description:
3CDaemon is a TFTP, FTP, and Syslog daemon for Microsoft Windows platforms. 3CDaemon is developed and maintained by 3Com.
3CDaemon is reportedly prone to multiple vulnerabilities. These issues may allow an attacker to crash the application, disclose sensitive information, and potentially execute arbitrary code on a vulnerable computer.
The following specific issues were identified:
Multiple format string vulnerabilities are reported to affect the application. These issues present themselves due to insufficient sanitization of user-supplied input. The source of the problems is incorrect usage of printf() type functions, allowing format specifiers to be supplied directly to vulnerable functions from external data. It is reported that an attacker can exploit these issues by supplying format specifiers in the username field during the authentication routine and through various FTP commands such as cd, delete, rename, rmdir, literal, stat, CWD and others.
A denial of service condition arises when a vulnerable server handles a malformed request. These issues may also allow an attacker to write to arbitrary process memory and potentially execute code. Any code executed through these vulnerabilities could potentially be carried out with the privileges of the server.
Multiple buffer overflow vulnerabilities affect the application as well. These issues are due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers. Specifically, an attacker can supply large string values to the application through the username field during the authentication routine and through various FTP commands such as cd, send, ls, put, delete, rename, rmdir, literal, stat, CWD and others.
These issues may allow remote attackers to execute arbitrary code on a vulnerable computer or crash the application.
3CDaemon also discloses sensitive information when a request for certain MS-DOS device names is carried out. The server reportedly returns the absolute path to the 3CDaemon directory when a cd command for a MS-DOS device or an existing file name is handled. This type of sensitive information may be used in further attacks against the computer.
3CDaemon 2.0 revision 10 is reported prone to these vulnerabilities, however, other versions may also be affected.
Affected Products:
- 3Com 3CDaemon 2.0.0 revision 10
References:
- 3Com: 3Com Home Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
