The FTPD glob vulnerability manifests itself in handling the glob command. The problem is not a typical buffer overflow or format string vulnerability, but a combination of two bugs - an implementation of the glob command that does not properly return an error condition when interpreting the string 'bracket', and then frees memory which may contain user-supplied data.

An attacker who is able to log in to a vulnerable server, including users with anonymous access, can exploit this to execute arbitrary code with the privileges of the FTP service.

The remote FTP server is vulnerable to a stack overflow when calling the 'strtok()' function. An attacker can exploit this flaw to execute arbitrary code on the remote host.

The remote host appears to be running GoodTech FTP Server for Windows. 

It was possible to disable the remote FTP server by connecting to it about 3000 separate times.  If the remote server is running from within [x]inetd, this is a feature and the FTP server should automatically be back in a couple of minutes.  An attacker may use this flaw to prevent this service from working properly.

It is possible to determine the existence of a user on the remote system by issuing the command CWD ~<username>, even before logging in.
An attacker can exploit this flaw to determine the existence of known vulnerable accounts.

It was possible to make the remote FTP server crash by creating a huge directory structure and then attempting to list list it using wildcards. This is usually known as the 'ftp glob overflow' attack.  It may be possible to exploit this to execute arbitrary code.

The remote FTP server is affected by a denial of service vulnerability that is triggered when it receives a specially crafted STAT command.
A remote attacker can exploit this to cause the consumption of all available memory.

The version of bftpd running on the remote host is vulnerable to a remote buffer overflow attack when issued very long arguments to the SITE CHOWN command.  A remote attacker could exploit this issue to crash the FTP server, or possibly execute arbitrary code.

The remote FTP server, which appears to be Bftpd, has a format string vulnerability in the NLST command.  A remote attacker could use this to crash the service, or possibly execute arbitrary code.

The remote host is running Serv-U FTP server. The installed version fails to properly sanitize user-supplied input to the 'cd' command. An attacker could exploit this flaw to access arbitrary files on the remote host.

Broker FTP appears to be running on the remote host. This version has a directory traversal vulnerability that allows a remote attacker to view and delete files outside of the FTP root directory.

The version of EFTP running on the remote host has a denial of service vulnerability. Sending data without a trailing carriage return causes the service to crash.

It was possible to log into the remote FTP server as ' ' / ' '. If the remote server is PFTP, then anyone can use this account to read arbitrary files on the remote host.

The remote ftp server does not sanitize properly the argument of the PASS command it receives for anonymous accesses.

It may be possible for a remote attacker to gain shell access.

It is possible to crash the remote FTP service by sending it a large number of null bytes. An attacker could exploit this flaw to deny access to the FTP server.

The FTP server running on the remote host is affected by a denial of service vulnerability when executing an MLST command. An unauthenticated, remote can exploit this to crash the server by using the 'MLST a' command just after making a connection.

The remote FTP server can be used to determine if a given file exists on the remote host or not, by adding dot-dot-slashes in front of them. This is caused by the server responding with different error messages depending on if the file exists or not.

An attacker may use this flaw to gain more knowledge about this host, such as its file layout. This flaw is specially useful when used with other vulnerabilities.

The FTP server running on the remote host is affected by a denial of service vulnerability when executing a RENAME TO (RNTO) command. An authenticated, remote attacker can crash the FTP server by executing the RENAME TO command before a RENAME FROM (RNFR) command.

The remote ProFTPd server is running a 1.2.0preN version.

All the 1.2.0preN versions contain several security flaws that allow an attacker to execute arbitrary code on this host.

The version of WU-FTPD hosted on the remote server does not properly sanitize the argument of the SITE EXEC command. It may be possible for a remote attacker to gain root access.

It was possible to crash the remote FTP server by issuing a USER command followed by a very long argument (over 16,000 characters).
This is likely due to a remote buffer overflow vulnerability.  A remote attacker could exploit this to crash the server, or possibly execute arbitrary code.

It was possible to make the remote FTP server crash by issuing the commands :

	CWD <buffer> 	CWD <buffer> 	CWD <buffer>

Where <buffer> is longer than 504 chars.	

An attacker can use this problem to prevent your FTP server from working properly, thus preventing legitimate users from using it.

It is possible to determine the existence of a user on the remote system by issuing the command CWD ~<username>. 

An attacker may use this to determine the existence of known to be vulnerable accounts (like guest) or to determine which system you are running.

The remote WU-FTPD server accepts the command 'SITE NEWER'.
Some WU-FTPD servers (and probably others) are vulnerable to a resource exhaustion where an attacker may invoke this command to use all the memory available on the server.

It was possible to crash the remote FTP server by issuing the command :

 CEL aaaa[...]aaaa

This problem is known as the 'AIX FTPd' overflow and may allow the remote user to easily gain access to the root (super-user) account on the remote system.

It was possible to crash the remote FTP server by issuing a specially crafted command, such as 'NLST aaaXXXX%u%[...]%u%u%u%%u%653300u%n' where 'XXXX' is replaced with four characters - ASCII values 0xDC, 0x4F, 0x07 and 0x08. This issue is known to affect ProFTPD version 1.2.0pre6, although other FTP servers may be affected as well.

It is likely that a remote attacker can leverage this issue to execute arbitrary code on the remote host, subject to the privileges under which the service runs.

It is possible to crash the remote FTP service by creating a large number of nested directories with names no longer than 255 chars. This issue is known to affect ProFTPD, although other FTP servers may be affected as well.

It is likely that a remote attacker can leverage this issue to execute arbitrary code on the remote host, subject to the privileges under which the service runs.

It was possible to make the remote FTP server crash by creating a huge directory structure. This is usually called the 'wu-ftpd buffer overflow' even though it affects other FTP servers.

An attacker can exploit this issue to crash the FTP server, or execute arbitrary code.

It was possible to crash the remote FTP server by creating a large number of nested directories and then trying to upload a file.  This issue is known to affect ProFTPD, although other FTP servers may be affected as well. 

It is likely that a remote attacker can leverage this issue to execute arbitrary code on the remote host, subject to the privileges under which the service runs.

The remote FTP server accepts any user/password combination. This can allow remote attackers to access the FTP account, which can lead to information disclosure and uploads of arbitrary files on the remote host.

The remote Windows host has a 'guest' FTP account enabled. This could allow a remote attacker to upload or download arbitrary files on the remote host.

Note that this plugin only tests for guest accounts over FTP.

It is possible to make the IIS FTP server close all the active connections by issuing a too long NLST command, which will make the server crash. An attacker can use this flaw to prevent people from downloading data from your FTP server.

The remote host is running a version of WU-FTPD that is affected by a command execution vulnerability. It is possible to execute arbitrary command son the remote host using the 'site exec' FTP problem.

The remote FTP server is affected by a buffer overflow vulnerability.
A remote, authenticated user can cause a denial of service via a long 'CWD' or 'LS' command. An attacker could exploit this to crash the affected host.

It is possible to write on the root directory of the remote anonymous FTP server. This allows an attacker to upload arbitrary files which can be used in other attacks, or to turn the FTP server into a software distribution point.

It is possible to determine the full path of the home directory of the 'ftp' user by issuing the 'CWD' command. An attacker can exploit this to determine where to put a .rhost file using other security flaws.

The remote FTP server fails to handle QUOTE PASV requests for logged in users. An attacker can send a specially crafted requests to cause the service to die and dump core. The core file contains the usernames and passwords of all users.

The remote FTP server allows users to make any amount of PASV commands, thus blocking the free ports for legitimate services and consuming file descriptors. An unauthenticated attacker could exploit this flaw to crash the FTP service.

The remote FTP server closes the connection when a command or argument is too long.  This is probably due to a buffer overflow and may allow an attacker to execute arbitrary code on the remote host.

The remote FTP server is affected by a flaw that may allow a remote attacker to gain unauthorized privileges. An attacker can exploit this flaw by issuing a specially crafted request to the 'CWD ~root' command.

It is possible to force the remote FTP server to connect to third parties using the PORT command. 

The problem allows intruders to use your network resources to scan other hosts, making them think the attack comes from your network.

Brute force setting must be enabled to use this plugin.

Nessus has detected that the FTP server running on the remote host allows anonymous logins. Therefore, any remote user may connect and authenticate to the server without providing a password or unique credentials. This allows the user to access any files made available by the FTP server.

ID	Name	Severity
10821	Multiple FTPD glob Command Arbitrary Command Execution	critical
10692	QNX RTP FTP stat Command strtok() Function Overflow	high
10690	GoodTech FTP Server Connection Saturation DoS	medium
10653	Solaris FTP Daemon CWD Command Account Enumeration	medium
10648	BSD Based FTP Server Multiple glob Function Remote Overflow	critical
10634	ProFTPD STAT Command Remote DoS	high
10579	bftpd Multiple Command Remote Overflow	critical
10568	bftpd NLST Command Output Format String	high
10565	Serv-U CD Command Encoded Traversal Arbitrary File/Directory Access	medium
10556	Broker FTP Multiple Command Arbitrary File/Directory Manipulation	high
10510	EFTP Newline String Handling Remote DoS	medium
10508	PFTP Default Unpassworded Account	critical
10490	HP-UX FTP Daemon PASS Command Remote Format String	critical
10488	Serv-U 2.5e Null Byte Saturation DoS	medium
10487	WFTPD Unauthenticated MLST Command DoS	high
10471	GuildFTPd Traversal Arbitrary File Enumeration	high
10466	WFTPD Out-of-Sequence RNTO Command DoS	medium
10464	ProFTPD Multiple Remote Overflows (palmetto)	critical
10452	WU-FTPD site_exec() Function Remote Format String	critical
10450	Dragon FTP USER Command Remote Overflow	critical
10293	Vermillion FTPD Long CWD Commands DoS	medium
10082	FTPd CWD Command Account Enumeration	medium
10319	WU-FTPD SITE NEWER Command Memory Exhaustion DoS	medium
10009	AIX FTPd libc Library Remote Buffer Overflow	critical
10191	ProFTPD NLST Command Argument Handling Remote Overflow	critical
10189	ProFTPD mkdir Buffer Overflow	critical
10318	WU-FTPD Multiple Vulnerabilities (OF, Priv Esc)	critical
10190	ProFTPD 1.2.0pre4 mkdir Command Directory Name Handling Remote Overflow	critical
10305	WFTP Unpassworded Guest Account	critical
10166	Windows NT FTP 'guest' Account Present	critical
10118	Microsoft IIS FTP Server NLST Command Overflow DoS	medium
10090	WU-FTPD SITE EXEC Arbitrary Local Command Execution	high
10089	Serv-U CWD Command Overflow	high
10088	Anonymous FTP Writable root Directory	critical
10087	Multiple FTP Server QUOTE CWD Command Home Path Disclosure	medium
10086	WU-FTPD QUOTE PASV Forced Core Dump Information Disclosure	medium
10085	Multiple Vendor FTP Multiple PASV Command Port Exhaustion DoS	medium
10084	Multiple FTP Server Command Handling Overflow	critical
10083	FTP 'CWD ~root' Command Privilege Escalation	critical
10081	FTP Privileged Port Bounce Scan	high
10079	Anonymous FTP Enabled	medium

Detections

Analytics

FTP Family for Nessus

critical

high

medium

medium

critical

high

critical

high

medium

high

medium

critical

critical

medium

high

high

medium

critical

critical

critical

medium

medium

medium

critical

critical

critical

critical

critical

critical

critical

medium

high

high

critical

medium

medium

medium

critical

critical

high

medium