TurboFTP 'DELE' FTP Command Remote Buffer Overflow

Medium Nessus Network Monitor Plugin ID 5300

Synopsis

The remote FTP server is vulnerable to a remote denial of service attack.

Description

The remote host is running the TurboFTP FTP server. The installed version of TurboFTP is earlier than 1.00.720. Such versions are potentially affected by a remote buffer overflow vulnerability when handling an overly large string that is passed to the 'DELE' FTP command. An attacker, exploiting this flaw, could crash the affected service.

Solution

Upgrade to TurboFTP 1.00.720

See Also

http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0202.html

http://www.tbsoftinc.com/tbserver/turboftp-server-releasenotes.htm

http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-004-turboftp-server-1-00-712-dos

Plugin Details

Severity: Medium

ID: 5300

Family: FTP Servers

Published: 2010/01/13

Updated: 2019/03/06

Dependencies: 1803, 1804, 3222

Nessus ID: 43877

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.5

Temporal Score: 5.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 6.2

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Patch Publication Date: 2010/01/11

Vulnerability Publication Date: 2010/01/12

Reference Information

BID: 37726