FTPShell Server Denial of Service Vulnerability

Bugtraq ID:	14382
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jul 26 2005 12:00AM
Updated:	Jul 26 2005 12:00AM
Credit:	Reed Arvin <[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	FTPshell FTPshell Server 3.38
Not Vulnerable:

FTPShell Server Denial of Service Vulnerability

FTPshell server is prone to a denial of service vulnerability. This issue is due to a failure in the application to handle exceptional conditions.

The problem presents itself when an attacker opens and closes, without using the 'quit' command, a connection to the application multiple times. This will cause the application to terminate. An attacker can exploit this vulnerability to deny service to legitimate users.

FTPShell Server Denial of Service Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/FTPShell_FTPDOS.pl

FTPShell Server Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

FTPShell Server Denial of Service Vulnerability

References:

• FTPshell Homepage (FTPshell)
  
• FTPShell Server Homepage (FTPshell)
  
• Denial of service vulnerability in FTPshell Server Version 3.38 (Reed Arvin )