MollenSoft Lightweight FTP Server Remote Denial Of Service Vulnerability

Bugtraq ID:	10409
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	May 24 2004 12:00AM
Updated:	May 24 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to STORM <[email protected]>.
Vulnerable:	Mollensoft Software Lightweight FTP Server 3.6
Not Vulnerable:

MollenSoft Lightweight FTP Server Remote Denial Of Service Vulnerability

A denial of service condition is reported to exist in the MollenSoft Lightweight FTP Server that may allow a remote user to deny service to legitimate FTP users. The vulnerability is due to a lack of sufficient boundary checks performed on CWD command arguments.

It should be noted that although this vulnerability is reported to affect Mollensoft Lightweight FTP Server version 3.6 other versions might also be affected.

MollenSoft Lightweight FTP Server Remote Denial Of Service Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/Mollensoft_FTP_Server_crash.pl

MollenSoft Lightweight FTP Server Remote Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

MollenSoft Lightweight FTP Server Remote Denial Of Service Vulnerability

References:

• Home Page (Mollensoft Software)
  
• Mollensoft Lightweight FTP Server CWD Buffer Overflow (Aviram Jenik )