HP-UX FTPD Remote Denial Of Service Vulnerability

Bugtraq ID:	16316
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jan 18 2006 12:00AM
Updated:	Jul 06 2006 11:44PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	HP Tru64 5.1 B-3 HP Tru64 5.1 B-2 PK4 HP Tru64 5.1 A PK HP Tru64 4.0 G PK4 HP Tru64 4.0 F PK8 HP HP-UX 11.23 HP HP-UX 11.11 HP HP-UX 11.0 4 HP HP-UX 11.0 HP HP-UX B.11.23 HP HP-UX B.11.11 HP HP-UX B.11.11 HP HP-UX B.11.04 HP HP-UX B.11.00 Avaya Predictive Dialing System (PDS) 12.0
Not Vulnerable:

HP-UX FTPD Remote Denial Of Service Vulnerability

A remote denial-of-service vulnerability has been reported in the HP-UX 'ftpd' implementation. A remote unauthenticated user may cause the FTP server process to become unresponsive.

The precise technical details of this vulnerability are currently unknown. This BID will be updated as further information becomes available.

HP-UX FTPD Remote Denial Of Service Vulnerability

No exploit is required.

HP-UX FTPD Remote Denial Of Service Vulnerability

Solution:
Please see the referenced advisories for more information:

- HP has released advisory HPSBUX02092 (SSRT5971 rev.1 - HP-UX Running ftpd Remote Denial of Service (DoS)) to address this issue.
- Avaya has released security advisory ASA-2006-018 detailing information on this issue regarding vulnerable Avaya products.


HP HP-UX 11.0

• HP PHNE_33406
  http://itrc.hp.com

HP HP-UX 11.0 4

• HP PHNE_34077
  http://itrc.hp.com

HP HP-UX 11.11

• HP PHNE_33412
  http://itrc.hp.com

HP HP-UX 11.23

• HP PHNE_33414
  http://itrc.hp.com

HP-UX FTPD Remote Denial Of Service Vulnerability

References:

• ASA-2006-018 - HP-UX Running ftpd Remote Denial of Service (HPSBUX02092) (Avaya)
  
• HP Tru64 Home Page (HP)
  
• HP-UX Homepage (HP)
  
• SSRT5971 rev.0 - HP Tru64 Unix FTP Daemon (ftpd) Remote Denial of Service (DoS) (HP)