httpd: NULL pointer defer in mod_proxy_ftp caused by crafted EPSV and PASV reply

The approxyftphandler function in modules/proxy/proxyftp.c in the modproxyftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service NULL pointer dereference and child process crash via a malformed reply to an EPSV command...

httpd: NULL pointer defer in mod_proxy_ftp caused by crafted EPSV and PASV reply

The approxyftphandler function in modules/proxy/proxyftp.c in the modproxyftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service NULL pointer dereference and child process crash via a malformed reply to an EPSV command...

httpd: NULL pointer defer in mod_proxy_ftp caused by crafted EPSV and PASV reply

The approxyftphandler function in modules/proxy/proxyftp.c in the modproxyftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service NULL pointer dereference and child process crash via a malformed reply to an EPSV command...

NcFTPD 2.8.5 Jail Breakout

NcFTPd googlemail.com / http://isowarez.de Date: 27th July 2009 Greetings: Alex,Andi,Adize,wY!,Netspy,Revoguard Prerequisites: Valid user account. Demonstration on FreeBSD 7.0-RELEASE and NcFTPd 2.8.5 latest version: ftp 192.168.2.5 Connected to 192.168.2.5. 220 localhost NcFTPd Server unregister...

CVE-2008-5666

WinFTP FTP Server 2.3.0, when passive aka PASV mode is used, allows remote authenticated users to cause a denial of service via a sequence of FTP sessions that include an invalid "NLST -1" command...

CVE-2008-5666

CVE-2008-5666 affects WinFTP Server 2.3.0. In PASV mode, a sequence of FTP sessions with an invalid NLST -1 can trigger a denial of service. Public sources (e.g., PacketStorm Metasploit PoC, OpenVAS entries) corroborate a PASV/NLST DoS vector but do not provide vendor-issued fixes within the supp...

CVE-2008-5666

WinFTP FTP Server 2.3.0, when passive aka PASV mode is used, allows remote authenticated users to cause a denial of service via a sequence of FTP sessions that include an invalid "NLST -1" command...

GLSA-200801-17 : Netkit FTP Server: Denial of Service

The remote host is affected by the vulnerability described in GLSA-200801-17 Netkit FTP Server: Denial of Service Venustech AD-LAB discovered that an FTP client connected to a vulnerable server with passive mode and SSL support can trigger an fclose function call on an uninitialized stream in...

[ GLSA 200801-17 ] Netkit FTP Server: Denial of Service

Gentoo Linux Security Advisory GLSA 200801-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Netkit FTP Server: Denial of service

Background net-ftp/netkit-ftpd is the Linux Netkit FTP server with optional SSL support. Description Venustech AD-LAB discovered that an FTP client connected to a vulnerable server with passive mode and SSL support can trigger an fclose function call on an uninitialized stream in ftpd.c. Impact A...

SuSE 10 Security Update : kdelibs3,kdelibs3-devel,CVE-2007-1564 (ZYPP Patch Number 3988)

A bug in konqueror allowed attackers to abuse the FTP passive mode for portscans. CVE-2007-1564 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29483;...

SuSE 10 Security Update : kdelibs3 (ZYPP Patch Number 3053)

A bug in KHTML could be exploited to conduct cross site scripting XSS attacks. CVE-2007-0537 Another bug allowed attackers to abuse the FTP passive mode for portscans. CVE-2007-1564 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

FTP protocol PASV design flaw affects konqueror

The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response...

security flaw

The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response...

Network protocols security: View from client side

Security of Common Application Network Protocols: A Client's Perspective Having received an offer to write an article about the security of network protocols and their vulnerabilities, at first I wanted to refuse - it seems that everything that can be written on this topic has already been writte...

3APA3A : Using FTP protocol weaknesses

How to exploit bugs in the implementation of the FTP protocol David Sacerdot, in his article on the vulnerability of the FTP protocol and dated as early as April 1996, theoretically the vulnerability of the FTP protocol if it is incorrectly implemented. Two points are interesting in the article,...

SACERDOTE

Some FTP data transfer protocol problems, common implementation errors and suggestions for fixing them David Sacerdote, [email protected] April, 1996, The icons .... show the translator's comments. The symbol ? shows places where the translator disagrees with the author. Original text of the...

SafeTP 1.46 - Passive Mode Internal IP Address Revealing

SafeTP 1.46 - Passive Mode Internal IP Address Revealing source: https://www.securityfocus.com/bid/5822/info SafeTP is a freely available, open source secure ftp client-server software package. It is available for Unix, Linux, and Microsoft Operating Systems. It has been reported that under some...

SafeTP 1.46 - Passive Mode Internal IP Address Revealing

source: https://www.securityfocus.com/bid/5822/info SafeTP is a freely available, open source secure ftp client-server software package. It is available for Unix, Linux, and Microsoft Operating Systems. It has been reported that under some circumstances, the SafeTP server may reveal sensitive...

File Transfer Protocol allows data connection hijacking via PASV mode race condition

Overview There is a vulnerability in the File Transfer Protocol FTP that allows an attacker to hijack FTP data connections when the client connects using passive mode PASV. Description In FTP PASV mode, the client makes a control connection to the FTP server typically port 21/tcp and requests a...