WFTPD Pro Administrative Control Panel Bug Lets Remote Authenticated Users Crash the GUI

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker Alert ID: 1009483

SecurityTracker URL: http://securitytracker.com/id/1009483

CVE Reference: GENERIC-MAP-NOMATCH (Links to External Site)

Date: Mar 18 2004

Impact: Denial of service via network

Fix Available: Yes Vendor Confirmed: Yes

Version(s): 3.21 Release 2, 3.21 Release 1

Description: A vulnerability was reported in WFTPD Pro. A remote authenticated user can cause the administrative interface to crash.

SecuriTeam reported that a remote authenticated user can send a long value of approximately 300 bytes as a parameter to almost all FTP commands to cause the active administrative interface applet to crash.

STORM is credited with discovering this flaw.

Impact: A remote user can cause the administrative interface to crash.

Solution: The vendor has released a fixed version (3.21 Release 3), available at:

http://www.wftpd.com/_derived/downloads.htm_cmp_blank110_gbtn.gif

Vendor URL: www.wftpd.com/What's%20New.html#321R3Pro (Links to External Site)

Cause: Boundary error

Underlying OS: Windows (Any)

Message History: None.


[Original Message Not Available for Viewing]