Dream FTP Server PORT Denial of Service Vulnerability - Advisories

Dream FTP Server PORT Denial of Service Vulnerability

Secunia Advisory:	SA23471
Release Date:	2006-12-22
Last Update:	2006-12-27

Critical:	Less critical
Impact:	DoS
Where:	From remote
Solution Status:	Unpatched

Software:	Dream FTP Server 1.x

CVE reference:	CVE-2006-6724 (Secunia mirror)

	This advisory is currently marked as unpatched! - Companies can be alerted when a patch is released!

Description: InTeL has discovered a vulnerability in Dream FTP Server, which can be exploited by malicious users to cause a DoS (Denial of Service). The vulnerability is caused due to an error in the handling of PORT commands. This can be exploited to crash the service by sending a "PORT" command with an invalid argument. The vulnerability is confirmed in version 1.02. Other versions may also be affected. Solution: Grant access to trusted users only. Provided and/or discovered by: InTeL Changelog: 2006-12-27: Added CVE reference. Original Advisory: http://milw0rm.com/exploits/2972



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

2 Related Secunia Security Advisories

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	HP TCP/IP Services for OpenVMS Finger Format String Vulnerability

2.	Novell eDirectory Multiple Vulnerabilities

3.	dotProject SQL Injection and Cross-Site Scripting

4.	Adium MSN SLP Message Integer Overflow Vulnerabilities

5.	Caudium "configvar" Insecure Temporary Files

6.	Red Hat update for libtiff

7.	Blogn Cross-Site Scripting and Cross-Site Request Forgery

8.	phpMyRealty "price_max" SQL Injection Vulnerability

9.	IBM WebSphere Application Server for z/OS HTTP Server mod_proxy_ftp Vulnerability

10.	phpJobScheduler "installed_conf ig_file" File Inclusion Vulnerabilities