Full Disclosure mailing list archives
smallftpd <= 1.0.3-fix | Connection Saturation Remote Denial of Service Vulnerability
From: YGN Ethical Hacker Group <lists () yehg net>
Date: Wed, 29 Jun 2011 17:07:17 +0800
smallftpd <= 1.0.3-fix | Connection Saturation Remote Denial of Service Vulnerability 1. OVERVIEW The smallftpd FTP server is found to be vulnerable to denial of service in handling multiple connection requests regardless of its maximum connection settings. Upon successful DoS exploit, the smallftpd will crash or reject new FTP login requests. 2. BACKGROUND The smallftpd FTP server isis a small and simple muli-threaded ftp server for windows. 3. VERSIONS AFFECTED 1.0.3-fix and earlier 4. PROOF-OF-CONCEPT/EXPLOIT http://dev.metasploit.com/redmine/attachments/1330/smallftpd103fix_saturation.rb http://www.exploit-db.com/download/17455 5. SOLUTION The vendor has discontinued this product and therefore has no patch or upgrade that mitigates this problem. It is recommended that an alternate software package be used in its place. 6. VENDOR Arnaud Mary 7. CREDIT This vulnerability was discovered by Myo Soe, http://yehg.net, YGN Ethical Hacker Group, Myanmar. 8. REFERENCES Original Advisory URL: http://core.yehg.net/lab/pr0js/advisories/smallftpd_103-fix_saturation_dos SmallFTPD Home Page: http://smallftpd.sourceforge.net/ SmallFTPD Download Stat: http://sourceforge.net/project/stats/?group_id=104723&ugn=smallftpd&type=&mode=alltime _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- smallftpd <= 1.0.3-fix | Connection Saturation Remote Denial of Service Vulnerability YGN Ethical Hacker Group (Jun 29)