Jose Miguel Esparza has discovered a vulnerability in wzdftpd, which can be exploited by malicious users to cause a DoS (Denial of Service).

The vulnerability is caused due to a NULL pointer dereference error within "chtbl_lookup()" when processing data sent by the user. This can be exploited to crash the service by sending certain whitespace characters (e.g. " ", "\r", "\n", "\t").

The vulnerability is confirmed in version 0.8.0. Other versions may also be affected.

Solution
Grant access to trusted users only.

Provided and/or discovered by
Jose Miguel Esparza, S21Sec

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.s21sec.com/avisos/s21sec-033-en.txt

Deep Links
Links available to Secunia VIM customers