Two vulnerabilities have been discovered in FTPXQ Server, which can be exploited by malicious users to cause a DoS (Denial of Service).

1) An error exists within the handling of the "MKD" command. This can be exploited to exhaust available CPU resources by either supplying an overly long argument or any number of certain special characters to the command.

2) An error when processing overly long arguments to FTP commands can be exploited to consume large amounts of CPU via e.g. an overly long argument passed to an "ABOR" command.

The vulnerabilities are confirmed in version 3.0.1. Other versions may also be affected.

Solution
Grant only trusted users access to the FTP service.

Provided and/or discovered by
1) Greg Linares
2) Platen

Changelog
Further details available to Secunia VIM customers

Original Advisory
2) http://milw0rm.com/exploits/9664

Deep Links
Links available to Secunia VIM customers