bugtraq - Denial of Service vulnerability in War FTP Daemon 1.82

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 26 Feb 2013 11:29:53 +0200
From: Jarle Aase <jgaa@...a.com>
To: bugtraq <bugtraq@...urityfocus.com>
Subject: Denial of Service vulnerability in War FTP Daemon 1.82

Late last week, security researchers at jura.ba reported a Denial of 
Service vulnerability in War FTP Daemon 1.82.

The problem was rooted in the way log messages was relayed from the 
internal log handler to the Windows Event log when the sever was running 
as a Windows service. Theoretically, it could be possible to execute 
remote code using this vulnerability.

I am therefore rating this vulnerability as critical.

A fix for the problem can be downloaded from http://www.warftp.org/?menu=344

jgaa
-- 
Jarle Aase                      email: jgaa@...a.com
Author of Free Software.        http://www.jgaa.com

War FTP Daemon:                 http://www.warftp.org
Other free software:            http://products.jgaa.com

NB: If you reply to this message, please include all relevant
information from the conversation in your reply. Thanks.
<<< no need to argue - just kill'em all! >>>