Solar FTP Server has a vulnerability that allows it to improperly handle format strings passed to the USER command. This can lead to a crash of the server due to a read access violation, resulting in a denial of service (DoS) condition. Attackers can exploit this vulnerability by sending specially crafted strings to the server.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2011-10029 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted string containing format specifiers to the USER command of the Solar FTP Server. This will trigger a read access violation in the server’s processing function, causing it to crash and resulting in a denial of service.
Affected Products
- Solar FTP Server: Affected version is 2.1.2, which is vulnerable to denial of service due to improper handling of format strings.
Mitigation
To mitigate this vulnerability, it is recommended to update the Solar FTP Server to the latest version that addresses this issue. Additionally, implementing network security measures such as firewalls and intrusion detection systems can help prevent unauthorized access and exploitation.