FTP.USER.Command.Overflow

Last Updated DateSep 24, 2009
Release DateSep 11, 2006
SeverityHigh
ImpactDenial of Service.
DescriptionThis indicates an attempt to exploit a buffer overflow vulnerability in some File Transfer Protocol (FTP) servers.

The vulnerability is due to inadequate user input validation of the "USER" command. A remote attacker can cause Denial of Service (DoS) on a vulnerable system by sending it a specially crafted FTP command.
Affected ProductsShadow Op Software Dragon Server versions 1.0 and 2.0
BlackMoon FTP Server versions prior to and including 1.5
FTP servers from other vendors are potentially vulnerable as well.
Recommended ActionsApply the appropriate patches or upgrade the system to the latest non-vulnerable version.
Common Vulnerabilities and Exposures (CVE)http://cve.mitre.org/cgi-bin/cvename.cgi?name=1999-0256
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2000-0479
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0126
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2005-3683
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-2212
Reference/shttp://www.securityfocus.com/bid/1352 (BugTraq)
http://www.securityfocus.com/bid/15457 (BugTraq)
http://www.securityfocus.com/bid/17835 (BugTraq)
http://www.securityfocus.com/bid/3884 (BugTraq)
Reference: VID-12923