Forum - Computer security: vulnerabilities and exploits database

[EN] securityvulns.ru
no-pyccku

Multiple FTP clients FTP bounce attack
updated since 05.03.2007
Published: 05.01.2009
Source: FULL-DISCLOSURE
SecurityVulns ID: 7348
Type: client
Level: 5/10
Description: Passive FTP implementation in multiple client allows to use FTP bounce attack for port scanning.

Affected: KDE : KDE 3.5
MOZILLA : Firefox 1.5
MOZILLA : Firefox 2.0
OPERA : Opera 9.10
DEV0 : 0irc 1.3
GOOGLE : Chrome 1.0
CVE: CVE-2007-1565 (Konqueror 3.5.5 allows remote attackers to cause a denial of service (crash) by using JavaScript to read a child iframe having an ftp:// URI.)
CVE-2007-1564 (The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.)
CVE-2007-1563 (The FTP protocol implementation in Opera 9.10 allows remote attackers to allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.)
CVE-2007-1562 (The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.)
CVE-2007-1308 (ecma/kjs_html.cpp in KDE JavaScript (KJS), as used in Konqueror in KDE 3.5.5, allows remote attackers to cause a denial of service (crash) by accessing the content of an iframe with an ftp:// URI in the src attribute, probably due to a NULL pointer dereference.)

Original document Aditya K Sood, Google Chrome FTP PASV IP Malicious Port Scanning Vulnerability. (05.01.2009)

mark, [Full-disclosure] Konqueror DoS Via JavaScript Read Of FTP Iframe (05.03.2007)

mark, [Full-disclosure] Extending JavaScript Portscanning to Include Banner Grabbing (05.03.2007)

Files: Manipulating FTP Clients Using The PASV Command PoC
Demo of how to make Konqueror 3.5.5 crash
Manipulating FTP Clients Using The PASV Command
Discuss: Read or add your comments to this news (0 comments)

Show		Threads
		Messages


Login:*		(Register)
Password:*
(private)	To:
(reply)	Subject:*
Text:

Main Forum (Eng) General security questions not appropriate for another forums.	3proxy Forum (Eng) All 3proxy question must be posted to this forum.	Bugs, Vulnerabilities, PoCs and Exploits (Eng) All vulnerability related questions, vulnerability digging and exploit creation.	Windows programming and administration (Eng) Administering Windows and application development.	Unix programming and administation (Eng) Administering Unix and application development.	Test forum Please post all test messages here. All test messages from different forums will be deteted.
Main Forum (Rus)	3proxy Forum (Rus)	Bugs, Vulnerabilities, PoCs and Exploits (Rus)	Windows programming and administration (Rus)	Unix programming and administation (Rus)