The remote ftp server does not properly sanitize output from the NLST command. It may be possible for remote attackers to gain root access if they can write in any directory served by this ftp daemon. 

The remote ftp server is vulnerable to a buffer overflow when issued too long arguments to the chown command. This vulnerability may make it possible for a remote attacker to gain root access.

It is possible to make the remote FTP server crash by issuing this command : CEL aaaa[...]aaaa. This problem is known as the 'AIX FTPd' overflow and may allow the remote user to easily gain access to the root (super-user) account on the remote system.

The remote FTP server allows anybody to switch to the root directory and read potentially sensitive files.

Platinum FTP server for Win32 has several vulnerabilities in the way it checks the format of command strings passed to it. This leads to the following vulnerabilities in the server: The 'dir' command can be used to examine the filesystem of the machine and gather further information about the host by using relative directory listings (I.E. '../../../' or '\..\..\..'). The 'delete' command can be used to delete any file on the server that the Platinum FTP server has permissions to. Issuing the command  'cd @/..@/..' will cause the Platinum FTP server to crash and consume all available CPU time on the server. 

The remote FTP server (smallftpd) is vulnerable to a flaw which allows users to access files outside of the FTP server root. 

The remote FTP server has anonymous access enabled. 

The remote server supports anonymous FTP with the login of 'ftp'.

A buffer overflow in FTP server in HPUX 11 and previous allows remote attackers to execute arbitrary commands by creating a long pathname and calling the STAT command, which uses glob to generate long strings.

The remote ProFTPd server is as old or older than 1.2.0rc2. There is a format string vulnerability in this version that might allow an attacker to execute arbitrary code on this host.

The remote FTP server is subject to two flaws:
- There is a configuration error in the postinst script, when the user enters 'yes', when asked if anonymous access should be enabled.  The postinst script wrongly leaves the 'run as uid/gid root' configuration option in /etc/proftpd.conf, and adds a 'run as uid/gid nobody' option that has no effect.
 There is a bug that comes up when /var is a symlink, and proftpd is restarted. When stopping proftpd, the /var symlink is removed; when it's started again a file named /var is created.  

The remote FTP server is running WebWeaver FTPd. There is a flaw in this server which may allow anyone to crash it remotely by requesting a non-existing file. 

The remote FTP server (SunFTP) allows a remote attacker to read arbitrary files on the remote host by adding a double dot in front of their name. In addition to this, it is vulnerable to a buffer overflow which may allow an attacker to execute arbitrary commands on the remote host.

The remote VXWorks host can be brought down entirely if a user issues a too long argument to the CEL ftp command.

The remote WFTP server crashes when it receives the command "RNTO x" right after the login. An attacker may use this flaw to prevent this host from publishing anything using FTP.

The remote WS_FTP server is vulnerable to various buffer overflows which may allow an attacker to execute arbitrary commands on this host.

The remote WU-FTP server is vulnerable to a buffer overflow when it receives a malformed glob command. An attacker may use this flaw to execute arbitrary code on this host.

The remote WU-FTPD server is vulnerable to a buffer overflow bug when it processes directories structure names. An attacker may use this flaw by creating a huge directory structure with specially malformed names, and may be able to execute arbitrary commands on this host with the privileges of the FTP daemon (typically, root)

The remote WU-FTPD server is vulnerable to a format string flaw when it is run in debug mode. An attacker may use this flaw to execute arbitrary code on this host by sending a PASV command with a specially crafted argument.

The remote WU-FTP server is vulnerable to a flaw which may allow an attacker to execute arbitrary code with its privileges (typically root) by sending a malformed argument to the SITE EXEC command.

The remote WU-FTPD server might be vulnerable to a resource exhaustion attack. To perform such an attack, one would have to log into this FTP server and issue bogus SITE NEWER commands.

The remote host is running a Novell FTP server. Older versions of this server can be disabled remotely by an attacker by sending a couple of NULL characters to the FTP administrative port.

The remote FTP server is running Eserv. There is a memory leak in this software which may be abused by an attacker to disable this service remotely. 

The remote host is running wu-ftpd 2.6.2 or older.  There is a bug in this version which may allow an attacker to bypass the restricted-gid feature and gain unauthorized access to otherwise restricted directories. In addition, this version is prone to a remote overflow in the S/KEY authentication.

The remote server is running a potentially vulnerable version of WFTPD. There are at least one remote stack-based buffer overflows and two remote Denial of Service (DoS) attacks that WFTPD is vulnerable to.

The remote host seems to be running TYPSoft FTP 1.10 or earlier.  TYPESoft FTP Server is prone to a remote denial of service vulnerability that may allow an attacker to cause the server to crash.

The remote host is running a TFTPD server. This server allows for unauthenticated file transfer to and from the host.

The remote host is running Serv-U FTP server.  There is a bug in the way this server handles arguments to the SITE CHMOD requests which may allow an attacker to trigger a buffer overflow against this server, which may allow him to disable this server remotely or to execute arbitrary code on this host.

The remote host is running Xlight FTP server.  There is a bug in the way this server handles arguments to the RETR command that may allow an attacker to trigger a buffer overflow against this server, potentially allowing him to disable this server remotely or to execute arbitrary code.

The remote host is running Sami FTP server.  There is a bug in the way some versions of this server handles certain FTP command requests which may allow an attacker to trigger a remote Denial of Service (DoS) attack against the server.

The remote FTP server (smallftpd) is vulnerable to a flaw that may allow a remote user to crash the server if the user specifies an overly long RETR command. Note that the remote user must have a valid username and password to exploit this flaw.

The remote Crob FTP Server is vulnerable to multiple overflows when issued standard FTP commands.

Yak! uses the FTP protocol to transfer files.  Yak! UserID and/or password may be a static value.  Versions prior to 2.1.0 have known default credentials.  An attacker can use this flaw to send arbitrary data to client machines.

The remote host is running SAMI FTP server.  It has been reported that this version of SAMI is vulnerable to a buffer overflow in the way that it handles USER and PASSWORD information.  An attacker exploiting this flaw would be able to execute arbitrary code on the remote SAMI FTP server.

The remote host appears to be using Gene6 FTP Server, a professional FTP server for Windows.  According to its banner, the version of Gene6 FTP Server installed on the remote host contains buffer overflow vulnerabilities that can be exploited by an authenticated, possibly anonymous, user with specially-crafted 'MKD', 'RMD', 'XMKD', and 'XRMD' commands to crash the affected application or execute arbitrary code on the affected host.

The remote host is running WarFTPd, an FTP server for the Microsoft platform. The version of WarFTPd running on this host contains a vulnerability that may allow a potential intruder to craft a special command such that execution of the command results in a buffer overflow.  Successful exploitation would allow the attacker to execute arbitrary code on the remote server.

The remote host is running FileZilla, an FTP server.  There is a flaw in the remote version of this software that may allow an authenticated attacker to issue a malformed request such that a buffer overflow occurs.  Successful exploitation would result in the attacker executing arbitrary code.

The remote host is running the ArGoSoft FTP Server.  This version of ArGoSoft FTP Server is vulnerable to a flaw when parsing a malicious RNTO command from an authenticated (or anonymous) user.  An attacker exploiting this flaw would be able to execute arbitrary code on the remote FTP server.

GlobalSCAPE Secure FTP Server is installed on the remote Windows host.  The installed version of GlobalSCAPE Secure FTP Server on the remote host is affected by a denial of service vulnerability involving a lengthy parameter line to an unspecified custom command.

The remote host is running a version of the Serv-U FTP Server that has an hidden default administration account. This account is reported to be hard-coded but it can be used only from the loopback interface. It may permit a local attacker to log into the site maintenance interface.

ID	Name	Severity
1829	bftpd < 1.0.13 Format String Overflow	high
1828	bftpd < 1.0.14 chown Command Overflow	critical
1827	AIX FTPd libc Library Remote Overflow	critical
1826	NiteServer < 1.85 FTP Server Traversal Directory Listing	medium
1825	Platinum FTP server Multiple Vulnerabilities	high
1824	SmallFTPD < 1.0.3 CWD Command Traversal Directory Listing	medium
1823	Anonymous FTP Enabled	low
1822	Anonymous FTP Detection (login: anonymous)	low
1821	Anonymous FTP Enabled	low
1820	Anonymous FTP Detection (login: ftp)	low
1819	HP-UX ftpd glob() Expansion STAT Command Remote Overflow	critical
1818	ProFTPD cwd Command Format String	critical
1817	Debian proftpd root Privilege Escalation	high
1816	WebWeaver FTP RETR Command Remote DoS	medium
1815	SunFTP Directory Traversal / Overflow	high
1814	VXWorks ftpd CEL Command Overflow DoS	high
1813	WFTP < 2.41 RNTO Command Handling DoS	medium
1812	WS_FTP < 2.0.3 Multiple Command Long Argument Overflows	critical
1811	WU-FTPD < 2.6.1 Glob Command Overflow	high
1810	WU-FTPD < 2.4.3 Directory Structure Processing Overflow	critical
1809	WU-FTPD < 2.6.2 PASV Command Format String Arbitrary Code Execution	high
1808	WU-FTPD < 2.6.1 'SITE EXEC' Command Overflow	critical
1807	WU-FTPD < 2.6.0 'SITE NEWER' Command Memory Exhaustion DoS	medium
1806	Novell FTP Malformed Input Remote DoS	medium
1805	Eserv FTP Memory Leak DoS (deprecated)	high
1804	FTP Server Detection (Port 21)	info
1803	FTP Server Detection	info
1208	WU-FTPD < 2.6.3 Multiple Vulnerabilities	high
1176	Windows NT FTP Server (WFTP) Pro Server < 3.21 Multiple Vulnerabilities	high
1175	TYPSoft FTP Server < 1.11 Invalid Path Request DoS	medium
1174	TFTP Server Detection	low
1168	Serv-U FTP Server < 4.2 SITE CHMOD Command Handling Overflow	high
1166	Xlight FTP Server < 1.53 RETR Command Remote Overflow	medium
1165	Sami FTP Server Multiple DoS	medium
1152	Smallftpd Crafted RETR Command Remote Overflow DoS	medium
1147	Crob FTP Server Connection Saturation Remote DoS	medium
1091	Yak! FTP Server Default Credentials (deprecated)	medium
3535	SAMI FTP Server <= 2.0.2 Authentication Credentials Remote Overflow	medium
3534	Gene6 FTP Server < 3.8.0.34 Multiple Command Remote Overflows	high
3533	WarFTP Daemon < 1.82.00-RC11 Remote Overflow	medium
3532	FileZilla FTP Server < 0.9.17 MLSD Command Overflow	medium
3529	ArGoSoft FTP Server < 1.4.3.7 RNTO Overflow	medium
3506	GlobalSCAPE Secure FTP Server < 3.1.4 Build 01.10.2006 Custom Command Remote DoS	medium
2115	Serv-U FTP Server Default Account	critical

Detections

Analytics

FTP Servers Family for Nessus Network Monitor

high

critical

critical

medium

high

medium

low

low

low

low

critical

critical

high

medium

high

high

medium

critical

high

critical

high

critical

medium

medium

high

info

info

high

high

medium

low

high

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

critical