WFTPD Pro Multiple Command Remote Denial of Service Vulnerabilities

Bugtraq ID:	33426
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jan 26 2009 12:00AM
Updated:	Jan 30 2009 10:59PM
Credit:	Gjoko 'LiquidWorm' Krstic
Vulnerable:	Texas Imperial Software WFTPD Pro 3.30 .1
Not Vulnerable:

WFTPD Pro Multiple Command Remote Denial of Service Vulnerabilities

WFTPD Pro is prone to multiple remote denial-of-service vulnerabilities because the application fails to handle specially crafted FTP commands in a proper manner.

Attackers can exploit these issues to crash the affected application, denying service to legitimate users.

WFTPD Pro 3.30.0.1 is vulnerable; other versions may also be affected.

UPDATE (January 29, 2009): This issue is reported to affect only servers that have the 'Enable Security' configuration option disabled.

WFTPD Pro Multiple Command Remote Denial of Service Vulnerabilities

The following exploit is available:

• /data/vulnerabilities/exploits/33426.c

WFTPD Pro Multiple Command Remote Denial of Service Vulnerabilities

Solution:
The vendor views this issue as a bug and plans to resolve it in an upcoming release.

WFTPD Pro Multiple Command Remote Denial of Service Vulnerabilities

References:

• WFTPD Homepage (Texas Imperial Software)