bugtraq - Serv-U up to 5.2 Denial of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 11 Sep 2004 08:49:43 -0000
From: Patrick <patrickthomassen@...il.com>
To: bugtraq@...urityfocus.com
Subject: Serv-U up to 5.2 Denial of Service

Serv-U FTP server is a secure, advanced FTP server for Windows. However, like most programs, it is not completely bugfree.

I (and maybe more people with me) found this bug some time ago. It can be triggered as *every* user that can log in, anonymous included, and exists in possibly every version. (At least 4.x and 5.x series).

The exploit might be a cliché but it might threaten (hosting and other) companies that use this FTP server.

Following commands will trigger the crash:

STOU COM1
STOU LPT1
STOU PRN
STOU AUX

However, "STOU NUL" does NOT work.

Greetings,
Patrick