Rumpus FTP Server HTTP Command Remote Denial of Service Vulnerability

Bugtraq ID:	32560
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 01 2008 12:00AM
Updated:	Dec 01 2008 11:53PM
Credit:	Blue Moon Consulting
Vulnerable:	Maxum Rumpus FTP Server 6.0
Not Vulnerable:	Maxum Rumpus FTP Server 6.0.1

Rumpus FTP Server HTTP Command Remote Denial of Service Vulnerability

Maxum Rumpus FTP Server is prone to a remote denial-of-service vulnerability.

This issue allows remote attackers to crash affected servers, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code within the context of the vulnerable application, but this has not been confirmed.

Versions prior to Rumpus 6.0.1 are vulnerable.

Rumpus FTP Server HTTP Command Remote Denial of Service Vulnerability

Attackers may use readily available network utilities to exploit this issue.

The following exploit is available:

• /data/vulnerabilities/exploits/32560.txt

Rumpus FTP Server HTTP Command Remote Denial of Service Vulnerability

Solution:
The vendor has released an updated version; please see the references for more information.

Rumpus FTP Server HTTP Command Remote Denial of Service Vulnerability

References:

• Rumpus 6.0.1 Is Now Available (Maxum)
  
• Rumpus FTP Server Product Page (Maxum)
  
• [BMSA 2008-09] Two buffer overflow vulnerabilities in Rumpus v6.0 (Nam Nguyen )