Description
Solar FTP Server fails to properly handle format strings passed to the USER command. When a specially crafted string containing format specifiers is sent, the server crashes due to a read access violation in the __output_1() function of sfsservice.exe. This results in a denial of service (DoS) condition.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Flexbyte Software Solar FTP Server
Default version status: unaffected
0 to ≤ 2.1.1affected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/dos/windows/ftp/solarftp_user.rb ↗
- https://www.exploit-db.com/exploits/16204 ↗
- https://web.archive.org/web/20111102141514/https://solarftp.com/ ↗
- https://web.archive.org/web/20111009122553/http://solarftp.com/blog/news/solar-ftp-server-2-1-2.html ↗
- https://www.vulncheck.com/advisories/solar-ftp-server-malformed-user-dos ↗