PT-2008-6718 · Wing Ftp · Winftp Server

Dmnt · Published 2008-12-18 · Updated 2017-09-29 · CVE-2008-5666

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions WinFTP FTP Server version 2.3.0

Description The issue allows remote authenticated users to cause a denial of service when passive mode is used. This can be achieved via a sequence of FTP sessions that include an invalid NLST -1 command.

Recommendations For WinFTP FTP Server version 2.3.0, consider disabling the passive mode as a temporary workaround until a patch is available. Restrict access to the FTP server to minimize the risk of exploitation. Avoid using the NLST command with invalid parameters in the affected FTP sessions until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-5666

Affected Products

Winftp Server

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/ftp/winftp230_nlst.rb · Exploit
• 🔥 https://exploit-db.com/exploits/6717 · Exploit
• 🔥 https://exploit-db.com/exploits/6581 · Exploit
• http://secunia.com/advisories/32209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5666 · Security Note
• http://securitytracker.com/id?1021040 · Note
• http://vupen.com/english/advisories/2008/2801 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45806 · Note
• http://securityreason.com/securityalert/4785 · Note