Home / vulnerabilities Secunia Security Advisory 47095
Posted on 06 December 2011
Source : packetstormsecurity.org Link
----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
Serv-U Data Connection Processing Denial of Service and Session Token
Weakness
SECUNIA ADVISORY ID:
SA47095
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/47095/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=47095
RELEASE DATE:
2011-12-05
DISCUSS ADVISORY:
http://secunia.com/advisories/47095/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/47095/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=47095
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Luigi Auriemma has discovered a vulnerability and a weakness in
Serv-U, which can be exploited by malicious users to cause a DoS
(Denial of Service) and bypass certain security restrictions.
1) An error when handling listening sockets to process a data
connection can be exploited to exhaust available TCP ports via a
large volume of FTP PASV commands resulting in inability to process
further passive connections.
2) The Management Console generates a weak session token when an
administrative user logs in, which allows to enumerate a valid token
and e.g. create an arbitrary user via the FTP bounce attack.
Successful exploitation of this weakness requires a user account with
read and write privileges and for an administrative user to have the
console open.
The vulnerability and the weakness are confirmed in version 11.1.0.3.
Other versions may also be affected.
SOLUTION:
Restrict access to trusted users only.
PROVIDED AND/OR DISCOVERED BY:
Luigi Auriemma
ORIGINAL ADVISORY:
Luigi Auriemma
http://aluigi.altervista.org/adv/servu_1-adv.txt
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
