PT-2024-1429 · Unknown · Solar Ftp Server

Fernando.Mengali · Published 2024-01-21 · Updated 2024-05-17 · CVE-2024-1016

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Solar FTP Server versions 2.1.1 through 2.1.2

Description The issue is related to an uncontrolled resource consumption in the PASV mode of the Solar FTP Server, which can be exploited by a remote attacker to cause a denial of service. The vulnerability affects the PASV Command Handler component and can be initiated remotely.

Recommendations For Solar FTP Server versions 2.1.1 and 2.1.2, apply a patch to fix this issue. As a temporary workaround, consider restricting access to the PASV Command Handler until a patch is available.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2024-00904

CVE-2024-1016

Affected Products

Solar Ftp Server

References · 9

• 🔥 https://packetstormsecurity.com/files/176675/Solar-FTP-Server-2.1.2-Denial-Of-Service.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-1016 · Security Note
• https://bdu.fstec.ru/vul/2024-00904 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1016 · Vendor Advisory
• https://vuldb.com/?ctiid.252286 · Note
• https://github.com/advisories/GHSA-4wm4-8487-w6cr · Note
• https://vuldb.com/?id.252286 · Note
• https://vuldb.com/ru/?id.252286 · Note
• https://t.me/cvenotify/69123 · Telegram Post