wzdftpd Login Remote Denial of Service Vulnerability
BID:8678
Info
wzdftpd Login Remote Denial of Service Vulnerability
| Bugtraq ID: | 8678 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 23 2003 12:00AM |
| Updated: | Sep 23 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Moran Zavdi <[email protected]>. |
| Vulnerable: |
wzdftpd wzdftpd 0.1 rc5 |
| Not Vulnerable: | |
Discussion
wzdftpd Login Remote Denial of Service Vulnerability
It has been reported that wzftpd is prone to a remote denial of service condition due to malicious user-supplied input. The problem is reported to present itself when a remote attacker sends a single CRLF character to the vulnerable program during the login process. This attack may cause the software to improperly handle the exceptional condition and lead to a crash.
Successful exploitation of this attack may allow a remote attacker to cause the vulnerable process to crash.
wzdftpd version 0.1rc5 has been reported to be prone to this vulnerability, however other version across various platforms may be affected as well.
It has been reported that wzftpd is prone to a remote denial of service condition due to malicious user-supplied input. The problem is reported to present itself when a remote attacker sends a single CRLF character to the vulnerable program during the login process. This attack may cause the software to improperly handle the exceptional condition and lead to a crash.
Successful exploitation of this attack may allow a remote attacker to cause the vulnerable process to crash.
wzdftpd version 0.1rc5 has been reported to be prone to this vulnerability, however other version across various platforms may be affected as well.
Exploit / POC
Solution / Fix
wzdftpd Login Remote Denial of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
wzdftpd Login Remote Denial of Service Vulnerability
References:
References:
- wzdftpd Homepage (wzdftpd)
- Moozatech: WZFTPD Denial Of Service ("Moran Zavdi"