Executive brief
A vulnerability in the standard File Transfer Protocol (FTP) allows remote attackers to disrupt file sharing services. By repeatedly requesting passive mode connections, an attacker can exhaust the server's available communication ports. This results in a denial of service, preventing legitimate users from connecting to or transferring files from the server.
Technical details
This vulnerability is a resource exhaustion flaw within the FTP protocol's handling of passive (PASV) mode requests. When a client issues a PASV command, the server opens a temporary port and waits for a data connection. An attacker can send a flood of PASV commands without ever completing the subsequent data connection, leading to the exhaustion of the server's ephemeral port range or available socket descriptors. This is a network-based attack that typically requires no authentication, depending on the FTP server configuration. The primary impact is a denial of service (DoS) for the FTP daemon.
Affected products
- Generic FTP Service
Timeline
- 1997-09-12: disclosed