From peter.grundl@DEFCOM.COM Tue Jan 23 00:10:43 2001 From: "Peter [iso-8859-1] Gründl" X-Sender: prg@astral.defcom.com To: BUGTRAQ@SECURITYFOCUS.COM Date: Mon, 22 Jan 2001 13:26:19 +0100 Subject: [BUGTRAQ] def-2001-03: GoodTech Systems FTP Connection DoS [The following text is in the "iso-8859-1" character set] [Your display is set for the "US-ASCII" character set] [Some characters may be displayed incorrectly] ====================================================================== Defcom Labs Advisory def-2001-03 GoodTech Systems FTP Connection DoS Author: Peter Gründl Release Date: 2001-01-22 ====================================================================== ------------------------=[Brief Description]=------------------------- The GoodTech FTP server does not properly free ressources. This can result in the FTP server either crashing or displaying its banner and immediately disconnecting the user. ------------------------=[Affected Systems]=-------------------------- - GoodTech Systems FTP 3.0.1.2.1.0 (evaluation build) ----------------------=[Detailed Description]=------------------------ Connecting approx. 2060-2080 times (one at a time) to the FTP server, using sockets, can result in the server either crashing or refusing to accept more connections. This appears to depend on the rate the connections are received by the FTP server. A fast flood results in a crash, whereas a slow flood results in the ftp banner being displayed and an immediate disconnect. ---------------------------=[Workaround]=----------------------------- Obtain the latest build from the vendor: http://www.goodtechsys.com -------------------------=[Vendor Response]=-------------------------- This issue was brought to the vendor's attention on the 11th of January, 2001. A workaround was received from the vendor on the 12th of January, 2001. ====================================================================== This release was brought to you by Defcom Labs labs@defcom.com www.defcom.com ======================================================================