XM Easy Personal FTP Server 'PORT and 'XCWD' Multiple Remote Denial of Service Vulnerabilities

Bugtraq ID:	28759
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 14 2008 12:00AM
Updated:	Apr 16 2008 12:30AM
Credit:	Muris Kurgas a.k.a. j0rgan
Vulnerable:	dxmsoft XM Easy Personal FTP Server 5.4
Not Vulnerable:

XM Easy Personal FTP Server 'PORT and 'XCWD' Multiple Remote Denial of Service Vulnerabilities

XM Easy Personal FTP Server is prone to multiple remote denial-of-service vulnerabilities.

These issues allow remote attackers to crash affected FTP servers, denying service to legitimate users. Given the nature of these issues, attackers may also be able to execute arbitrary code, but this has not been confirmed.

XM Easy Personal FTP Server 5.4.0 is vulnerable; other versions may also be affected.

XM Easy Personal FTP Server 'PORT and 'XCWD' Multiple Remote Denial of Service Vulnerabilities

Attackers may use readily available network utilities to exploit these issues.

The following exploits are available:

• /data/vulnerabilities/exploits/28759-1.pl
• /data/vulnerabilities/exploits/28759-2.pl

XM Easy Personal FTP Server 'PORT and 'XCWD' Multiple Remote Denial of Service Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

XM Easy Personal FTP Server 'PORT and 'XCWD' Multiple Remote Denial of Service Vulnerabilities

References:

• XM Easy Personal FTP Server Home Page (dxmsoft)