Cerberus FTP Server Command Processing DoS

medium Nessus Plugin ID 40821

Synopsis

The FTP server installed on the remote Windows host has a denial of service vulnerability.

Description

The version of Cerberus FTP server on the remote host has a denial of service vulnerability. Sending a very long argument (1400 bytes or more) to any command causes the server to crash. This reportedly does not result in memory corruption - the vulnerable versions abnormally terminate when a long argument is received (before any data is successfully copied into the destination buffer). A remote attacker could exploit this issue to cause a denial of service.

Solution

Upgrade to Cerberus FTP server 3.0.2 or later.

Plugin Details

Severity: Medium

ID: 40821

File Name: cerberus_ftp_3_0_2.nasl

Version: 1.15

Type: local

Agent: windows

Family: FTP

Published: 8/31/2009

Updated: 10/16/2020

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS Score Rationale: No cve available: dos

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: manual

Vulnerability Information

CPE: cpe:/a:cerberusftp:ftp_server

Required KB Items: SMB/CerberusFTP/Installed

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/16/2009

Vulnerability Publication Date: 8/12/2009

Reference Information

BID: 36134

Secunia: 36456

Detections

Analytics