Home FTP Server 'SITE INDEX' Command Remote Denial of Service Vulnerability

Bugtraq ID:	37033
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 16 2009 12:00AM
Updated:	May 28 2010 05:51PM
Credit:	zhangmc[at]mail.ustc.edu.cn
Vulnerable:	Home Ftp Server Home Ftp Server 1.10.3 Home Ftp Server Home Ftp Server 1.10.1 .139 Home Ftp Server Home Ftp Server 1.10 .138 Home Ftp Server Home Ftp Server 1.0.7 b45 Home Ftp Server Home Ftp Server 1.4.5 Build 84 Home Ftp Server Home Ftp Server 1.3.4.93
Not Vulnerable:

Home FTP Server 'SITE INDEX' Command Remote Denial of Service Vulnerability

Home FTP Server is prone to a remote denial-of-service vulnerability because it fails to handle user-supplied input.

Successfully exploiting this issue allows remote attackers to crash the affected application, denying service to legitimate users.

Home FTP Server 'SITE INDEX' Command Remote Denial of Service Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/37033.py
• /data/vulnerabilities/exploits/37033-2.py

Home FTP Server 'SITE INDEX' Command Remote Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Home FTP Server 'SITE INDEX' Command Remote Denial of Service Vulnerability

References:

• Home Ftp Server Product Page (Home Ftp Server)
  
• Home FTP Server 'SITE INDEX' Command Remote Denial of Service Vulnerability ([email protected])