Win FTP NLST Command Processing Bug Lets Remote Authenticated Users Deny Service

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker Alert ID: 1021040

SecurityTracker URL: http://securitytracker.com/id/1021040

CVE Reference: CVE-2008-5666 (Links to External Site)

Updated: Dec 26 2008

Original Entry Date: Oct 14 2008

Impact: Denial of service via network

Exploit Included: Yes

Version(s): 2.3.0

Description: A vulnerability was reported in Win FTP. A remote authenticated user can cause denial of service conditions.

A remote authenticated user, including an anonymous user, can send a specially crafted NLST command in PASV mode to cause the target service to crash.

A demonstration exploit is available at:

http://milw0rm.com/exploits/6717

dmnt reported this vulnerability.

Impact: A remote authenticated user can cause the target service to crash.

Solution: No solution was available at the time of this entry.

Vendor URL: wftpserver.com/ (Links to External Site)

Cause: Exception handling error

Underlying OS: Windows (Any)

Message History: None.

Date: Mon, 13 Oct 2008 20:19:02 -0400
Subject: Win FTP


http://milw0rm.com/exploits/6717