Cerberus FTPServer Remote Denial of Service Vulnerability
BID:8452
Info
Cerberus FTPServer Remote Denial of Service Vulnerability
| Bugtraq ID: | 8452 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 20 2003 12:00AM |
| Updated: | Feb 07 2006 08:55PM |
| Credit: | This vulnerability was reported by "Aditya [Aditya Lalit Desgmukh]" <[email protected]>. |
| Vulnerable: |
Cerberus FTP Server 2.32 Cerberus FTP Server 2.1 Cerberus FTP Server 1.71 |
| Not Vulnerable: | |
Discussion
Cerberus FTPServer Remote Denial of Service Vulnerability
It has been reported that some versions of Cerberus FTP Server may be prone to remote denial of service attacks. The problem is said to occur when the order of a carriage return and line feed are prefixed to a specific command, rather then appended. When this data is interpreted by the FTP server, the application supposedly crashes. The precise technical details regarding where the issue lies and why it occurs are currently unknown. This BID will be updated as further information becomes available.
It has been reported that some versions of Cerberus FTP Server may be prone to remote denial of service attacks. The problem is said to occur when the order of a carriage return and line feed are prefixed to a specific command, rather then appended. When this data is interpreted by the FTP server, the application supposedly crashes. The precise technical details regarding where the issue lies and why it occurs are currently unknown. This BID will be updated as further information becomes available.
Exploit / POC
Cerberus FTPServer Remote Denial of Service Vulnerability
A sample perl script has been supplied which demonstrates the exploitation of this issue.
Exploit code 'cerberus_232_dos_remote_xpl.c' has been supplied by <[email protected]>.
A sample perl script has been supplied which demonstrates the exploitation of this issue.
Exploit code 'cerberus_232_dos_remote_xpl.c' has been supplied by <[email protected]>.
Solution / Fix
Cerberus FTPServer Remote Denial of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Cerberus FTPServer Remote Denial of Service Vulnerability
References:
References:
- Cerberus FTP Server 2.32 Denial of Service (KAPDA)
- FTP Server Homepage (Cerberus)