PT-2008-6718 · Wing Ftp · Winftp Server

Dmnt · Publicado 2008-12-18 · Atualizado 2017-09-29 · CVE-2008-5666

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions WinFTP FTP Server version 2.3.0

Description The issue allows remote authenticated users to cause a denial of service when passive mode is used. This can be achieved via a sequence of FTP sessions that include an invalid NLST -1 command.

Recommendations For WinFTP FTP Server version 2.3.0, consider disabling the passive mode as a temporary workaround until a patch is available. Restrict access to the FTP server to minimize the risk of exploitation. Avoid using the NLST command with invalid parameters in the affected FTP sessions until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2008-5666

Produtos afetados

Winftp Server

Referências · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/ftp/winftp230_nlst.rb · Exploit
• 🔥 https://exploit-db.com/exploits/6717 · Exploit
• 🔥 https://exploit-db.com/exploits/6581 · Exploit
• http://securitytracker.com/id?1021040 · Nota
• http://secunia.com/advisories/32209 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/2801 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45806 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5666 · Nota de Segurança
• http://securityreason.com/securityalert/4785 · Nota