Check Point Advisories

Preemptive Protection against Crob FTP Server Denial of Service Vulnerability

Check Point Reference:	CPAI-2006-154
Date Published:	26 Dec 2006
Severity:	Low
Last Updated:	Wednesday 02 May, 2007
Source:	Secunia Advisory: SA23365
Industry Reference:	CVE-2006-6558
Protection Provided by:
Who is Vulnerable?	Crob FTP Server version 3.6.1 build 263
Vulnerability Description	A denial of service vulnerability has been reported in Crob FTP Server. Crob FTP server is an FTP server application for Microsoft Windows. The vulnerability could be exploited by remote attackers to crash the application via a specially crafted FTP command sent to an affected server.
Vulnerability Details	The vulnerability is caused due to an error when processing malformed 'LIST' commands. A remote attacker can cause the service to crash via an overly long argument composed of certain characters passed to the 'LIST' command. Successful exploitation may cause denial of service condition.