Ipswitch WS_FTP Server Resource Consumption Remote Denial Of Service Vulnerability

Bugtraq ID:	9237
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Dec 17 2003 12:00AM
Updated:	Dec 17 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Dr_insane.
Vulnerable:	Ipswitch WS FTP Server 4.0 2 Ipswitch WS FTP Server 4.0 1 Ipswitch WS FTP Server 4.0 Ipswitch WS FTP Server 3.4 Ipswitch WS FTP Server 3.1.3 Ipswitch WS FTP Server 3.1.2 Ipswitch WS FTP Server 3.1.1 Ipswitch WS FTP Server 3.1 Ipswitch WS FTP Server 3.0 1 Ipswitch WS FTP Server 3.0 Ipswitch WS FTP Server 2.0.4 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Ipswitch WS FTP Server 2.0.3 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 Ipswitch WS FTP Server 2.0.2 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 Ipswitch WS FTP Server 2.0.1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 Ipswitch WS FTP Server 2.0 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 Ipswitch WS FTP Server 1.0.5 Ipswitch WS FTP Server 1.0.4 Ipswitch WS FTP Server 1.0.3 Ipswitch WS FTP Server 1.0.2 Ipswitch WS FTP Server 1.0.1
Not Vulnerable:

Ipswitch WS_FTP Server Resource Consumption Remote Denial Of Service Vulnerability

WS_FTP Server has been reported prone to a resource consumption issue that may lead to a denial of service. It has been reported that a remote attacker may trigger this vulnerability by passing a sequence of periods as an argument of the Change Working Directory FTP command. Subsequent to this action, the attacker will need to create a directory. This will reportedly cause the WS_FTP server to exponentially consume system resources and behave in an unstable manner.

Ipswitch WS_FTP Server Resource Consumption Remote Denial Of Service Vulnerability

There is no exploit required.

Ipswitch WS_FTP Server Resource Consumption Remote Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Ipswitch WS_FTP Server Resource Consumption Remote Denial Of Service Vulnerability

References:

• Ipswitch Homepage (Ipswitch)
  
• WS FTP Server Support Homepage (IPSwitch)