PureFTPd Accept_Client Remote Denial of Service Vulnerability
BID:10664
Info
PureFTPd Accept_Client Remote Denial of Service Vulnerability
| Bugtraq ID: | 10664 |
| Class: | Design Error |
| CVE: |
CVE-2004-0656 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 05 2004 12:00AM |
| Updated: | Mar 19 2015 09:29AM |
| Credit: | This vulnerability was announced in a vendor advisory. |
| Vulnerable: |
PureFTPd PureFTPd 1.0.18 PureFTPd PureFTPd 1.0.17 a PureFTPd PureFTPd 1.0.16 c PureFTPd PureFTPd 1.0.16 b PureFTPd PureFTPd 1.0.16 a PureFTPd PureFTPd 1.0.16 PureFTPd PureFTPd 1.0.15 PureFTPd PureFTPd 1.0.14 PureFTPd PureFTPd 1.0.13 a PureFTPd PureFTPd 1.0.12 PureFTPd PureFTPd 1.0.11 PureFTPd PureFTPd 1.0.5 PureFTPd PureFTPd 1.0.4 PureFTPd PureFTPd 1.0.3 PureFTPd PureFTPd 1.0.2 PureFTPd PureFTPd 1.0.1 PureFTPd PureFTPd 1.0 PureFTPd PureFTPd 0.96 |
| Not Vulnerable: |
PureFTPd PureFTPd 1.0.19 |
Discussion
PureFTPd Accept_Client Remote Denial of Service Vulnerability
PureFTPd is reported prone to a remote undisclosed denial of service vulnerability. The vulnerability is reported to exist due to a bug in the accept_client function used to setup new connections. It is reported that when the maximum number of connections is reached an attacker may be able to deny service to the affected daemon.
It is reported that all versions of cPanel are also affected by this issue because cPanel ships with PureFTPd 1.0.12.
PureFTPd is reported prone to a remote undisclosed denial of service vulnerability. The vulnerability is reported to exist due to a bug in the accept_client function used to setup new connections. It is reported that when the maximum number of connections is reached an attacker may be able to deny service to the affected daemon.
It is reported that all versions of cPanel are also affected by this issue because cPanel ships with PureFTPd 1.0.12.
Exploit / POC
PureFTPd Accept_Client Remote Denial of Service Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
PureFTPd Accept_Client Remote Denial of Service Vulnerability
Solution:
The vendor has released pure-ftpd version 1.0.19 to address this issue.
Gentoo has released an advisory (GLSA 200407-04) and an updated eBuild to address this issue. Gentoo users are advised to commit the following commands as a superuser in order to apply the updated eBuild:
emerge sync
emerge -pv ">=net-ftp/pure-ftpd-1.0.18-r1"
emerge ">=net-ftp/pure-ftpd-1.0.18-r1"
PureFTPd Pure-FTPd 0.96
PureFTPd Pure-FTPd 1.0
PureFTPd Pure-FTPd 1.0.1
PureFTPd Pure-FTPd 1.0.11
PureFTPd Pure-FTPd 1.0.12
PureFTPd Pure-FTPd 1.0.13 a
PureFTPd Pure-FTPd 1.0.14
PureFTPd Pure-FTPd 1.0.15
PureFTPd Pure-FTPd 1.0.16 b
PureFTPd Pure-FTPd 1.0.16 a
PureFTPd Pure-FTPd 1.0.16 c
PureFTPd Pure-FTPd 1.0.16
PureFTPd Pure-FTPd 1.0.17 a
PureFTPd Pure-FTPd 1.0.2
PureFTPd Pure-FTPd 1.0.3
PureFTPd Pure-FTPd 1.0.4
PureFTPd Pure-FTPd 1.0.5
Solution:
The vendor has released pure-ftpd version 1.0.19 to address this issue.
Gentoo has released an advisory (GLSA 200407-04) and an updated eBuild to address this issue. Gentoo users are advised to commit the following commands as a superuser in order to apply the updated eBuild:
emerge sync
emerge -pv ">=net-ftp/pure-ftpd-1.0.18-r1"
emerge ">=net-ftp/pure-ftpd-1.0.18-r1"
PureFTPd Pure-FTPd 0.96
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.1
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.11
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.12
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.13 a
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.14
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.15
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.16 b
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.16 a
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.16 c
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.16
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.17 a
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.2
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.3
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.4
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
PureFTPd Pure-FTPd 1.0.5
-
PureFTPd pure-ftpd-1.0.19.tar.gz
ftp://ftp.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.19.tar.gz
References
PureFTPd Accept_Client Remote Denial of Service Vulnerability
References:
References:
- PureFTPd Home Page (PureFTPd)