CVE-2008-5666 - WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to

CVE-2008-5666

Summary

WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to cause a denial of service via a sequence of FTP sessions that include an invalid "NLST -1" command.

References

http://secunia.com/advisories/32209
http://securityreason.com/securityalert/4785
http://www.securitytracker.com/id?1021040
http://www.vupen.com/english/advisories/2008/2801
https://exchange.xforce.ibmcloud.com/vulnerabilities/45806
https://www.exploit-db.com/exploits/6717

Vulnerable Configurations

cpe:2.3:a:wftpserver:winftp_ftp_server:2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:wftpserver:winftp_ftp_server:2.3.0:*:*:*:*:*:*:*

CVSS

Base:	3.5 (as of 29-09-2017 - 01:32)
Impact:
Exploitability:

CWE

CWE-399

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	SINGLE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:S/C:N/I:N/A:P

refmap via4

exploit-db	6717
sectrack	1021040
secunia	32209
sreason	4785
vupen	ADV-2008-2801
xf	winftpserver-nlst-dos(45806)

Last major update

29-09-2017 - 01:32

Published

19-12-2008 - 01:52

Last modified

29-09-2017 - 01:32