CVE-2010-3972
Microsoft Internet Information Services FTP Service 7.0-7.5 - Remote Code Execution via Crafted FTP Command
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-3972.
PoCs published by Matthew Bergin, Matthew Bergin, jduck, including Metasploit module auxiliary/dos/windows/ftp/iis75_ftpd_iac_bof.
AI-analyzed exploit summary This exploit triggers a denial-of-service (DoS) condition in Windows 7 IIS 7.5 by sending a malformed FTP command with an overly long buffer. The payload consists of repeated bytes designed to crash the FTPSVC service.
Description
Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) 7.0, and IIS 7.5, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted FTP command, aka "IIS FTP Service Heap Buffer Overrun Vulnerability." NOTE: some of these details are obtained from third party information.
Exploits (2)
This exploit triggers a denial-of-service (DoS) condition in Windows 7 IIS 7.5 by sending a malformed FTP command with an overly long buffer. The payload consists of repeated bytes designed to crash the FTPSVC service.
This Metasploit module exploits a heap overflow in Microsoft IIS FTP Server by sending a crafted FTP request with Telnet IAC bytes, leading to a denial-of-service (DoS) condition. The vulnerability (CVE-2010-3972) is triggered pre-authentication and may be exploitable for remote code execution.