Titan FTP Server LIST Denial Of Service Vulnerability

Bugtraq ID:	10272
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	May 04 2004 12:00AM
Updated:	May 04 2004 12:00AM
Credit:	<[email protected]> is credited for finding this vulnerability.
Vulnerable:	South River Technologies Titan FTP Server 3.0 1
Not Vulnerable:	South River Technologies Titan FTP Server 3.10

Titan FTP Server LIST Denial Of Service Vulnerability

Titan FTP is prone to a remote denial of service vulnerability when handling the 'LIST' command.

A remote attacker can cause the FTP server to crash by improperly handling a non-existent socket.

Titan FTP Server LIST Denial Of Service Vulnerability

An untested exploit has been provided by <[email protected]>.

• /data/vulnerabilities/exploits/titan_ftp_dos.pl

Titan FTP Server LIST Denial Of Service Vulnerability

Solution:
The vendor has released an upgraded version that fixes this issue.

If you have a licensed version, there is a 'Check for Program Update' utility available in the 'Titan FTP Server' program group which should upgrade the application.


Southrivertech Titan FTP Server 3.0 1

• South River Technologies titanftp.exe
  Please note that this is the evaluation version of the software. If you have a licensed copy, there is a 'Check for Program Update' utility available with your installation.
  http://srt.swmirror.com/titanftp.exe

Titan FTP Server LIST Denial Of Service Vulnerability

References:

• Titan FTP Server Homepage (South River Technologies)
  
• Titan FTP Server Aborted LIST DoS (Aviram Jenik )