acFTP REST/PBSZ Argument Handling Denial of Service

Posted on Tuesday, December 26, 2006 @ 17:10:25 UTC in Security
by Raven

SECUNIA ADVISORY ID: SA23481

VERIFY ADVISORY: http://secunia.com/advisories/23481/

CRITICAL: Moderately critical

IMPACT: DoS

SOFTWARE: acFTP 1.x - http://secunia.com/product/9764/

DESCRIPTION: Gabriel Silva has discovered two vulnerabilities in acFTP, which can be exploited by malicious users and malicious people to cause a DoS (Denial of Service).
The vulnerabilities are caused due to input validation errors when handling arguments passed to the REST and PBSZ commands. This can be exploited to crash the service by passing a specially crafted string as argument to either of the affected commands. Successful exploitation using the REST command requires a valid user account. The vulnerabilities are confirmed in version 1.5. Other versions may also be affected.

SOLUTION: Restrict access to the service.

PROVIDED AND/OR DISCOVERED BY: Gabriel Silva
 
 
click Related        click Share
 
News ©

Site Info

Last SeenLast Seen
  • neralex
  • nextgen
Server TrafficServer Traffic
  • Total: 481,621,375
  • Today: 6,542
Server InfoServer Info
  • Mar 28, 2024
  • 08:49 am UTC