COMMAND

    kernel

SYSTEMS AFFECTED

    Win98

PROBLEM

    'ByteRage' posted following.  This was tested on Windows 98 (first
    edition)  *with*  CON\CON  kernel  patch  by  MicroSoft.  Although
    this is an OS matter,  here are some affected ftp  server programs
    found:

        BisonFTP V4R1
        Broker FTP Server 5.9.5.0
        G6 FTP Server v2.15 (AKA BulletProof FTP Server)
        GuildFTPD 0.922
        SurgeFTP 2.0f
        WarFTPD 1.71
        WFTPD 3.00 R5
        ...

    The  AUX  read  bug  has  already  been  discussed by neme-dhc for
    Xitami webserver &  Small http server  and there maybe  also other
    advisories out there, but most  of them seem to regard  these bugs
    as originating from the server software, which is not the case.

    On the tested win98 system, when programs accessed the AUX  device
    for reading, CPU  usage increased to  100%, and in  most cases the
    computer would completely freeze.

    Sometimes server software  had filtering to  prevent 'downloading'
    (GET)  the  AUX   device,  but  this   filtering  can  easily   be
    circumvented by referring to the  device as AUX. (with a  trailing
    dot, or maybe appending an  extension like AUX.FOO or by  randomly
    appending dots & spaces (AUX. . .. ... .. .)).

    Serv-U FTP  version 3.0  & ArGoSoft  FTP Server  1.2.2.2 were  the
    only  server  program  that  were  immune  to attack even with the
    trickery, so they must be  filtering out devices using API  calls,
    which is a good idea from a security standpoint.

SOLUTION

    Nothing yet.