SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

SurgeFTP Denial of Service


Arrow  SecurityAlert : 2883
Arrow  CVE : CVE-2007-3768
Arrow  SecurityRisk : Medium  Security Risk Medium  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : Yes
Arrow  Exploit Available : Yes
Arrow  Credit : Nico Leidecker
Arrow  Published : 17.07.2007

Arrow  Affected Software : SurgeFTP



Arrow  Advisory Content :  

Portcullis Security Advisory 06-061

Vulnerable System:

SurgeFTP


Vulnerability Title:

The mirror mechanism allows Denial of Service.


Vulnerability discovery and development:

Portcullis Security Testing Services discovered this vulnerability.
Further research was then carried out.


Credit for Discovery:

Nico Leidecker - Portcullis Computer Security Ltd.


Affected systems:

Version 2.3a1 Linux and is likely to affect other platforms.


Details:

SurgeFTP provides a mirror functionality but fails to detect malformated
command responses. This concerns the PASV command and its response from
the
mirrored server. SurgeFTP fails to parse a response to PASV properly so
that
it will crash if the response was malformated.


Impact:

It may be possible for an attacker to shut down the service. By default,
SurgeFTP respawns after a couple of seconds. But then, immediately
reconnects
to the mirrored server. As long as the attacker keeps sending malformated
PASV responses to the server, it will keep shutting down immediately after

restarting.


Exploit:

The proof of concept exploit code is available.


Vendor Status:

Vendor notified. The vulnerability has been fixed.


Copyright:

Copyright Š Portcullis Computer Security Limited 2005, All rights reserved

worldwide.

Permission is hereby granted for the electronic redistribution of this
information. It is not to be edited or altered in any way without the
express
written consent of Portcullis Computer Security Limited.


Disclaimer:

The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There are
NO
warranties, implied or otherwise, with regard to this information or its
use.
Any use of this information is at the user's risk. In no event shall the
author/distributor (Portcullis Computer Security Limited) be held liable
for
any damages whatsoever arising out of or in connection with the use or
spread
of this information.




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc:fts_*() Multiple Denial of Service

Security Risk Medium- 2009-10-02

The fts functions are provided for traversing UNIX file hierarchies...
Apache RSS Apache Alert

» Apache 1.3.41 mod_proxy
   Integer overflow (code
   execution)

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion in work
   directory

» Apache Tomcat 6.0.20 and
   5.5.28 insecure partial
   deploy after failed
   undeploy

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion and/or
   alteration
PHP RSS PHP Alert

» PHP 5.2.12/5.3.1
   session.save_path
   safe_mode and
   open_basedir bypass

» PHP 5.2.12/5.3.1 Multiple
   Vulnerabilities

» PHP 5.2.11 libgd multiple
   vulnerabilities

» PHP 5.2.11 tempnam()
   safe_mode bypass
Copyright © SecurityReason.com. All Rights Reserved.