SECUNIA ADVISORY ID: SA23481

VERIFY ADVISORY: http://secunia.com/advisories/23481/

CRITICAL: Moderately critical

IMPACT: DoS

SOFTWARE: acFTP 1.x - http://secunia.com/product/9764/

DESCRIPTION: Gabriel Silva has discovered two vulnerabilities in acFTP, which can be exploited by malicious users and malicious people to cause a DoS (Denial of Service). The vulnerabilities are caused due to input validation errors when handling arguments passed to the REST and PBSZ commands. This can be exploited to crash the service by passing a specially crafted string as argument to either of the affected commands. Successful exploitation using the REST command requires a valid user account. The vulnerabilities are confirmed in version 1.5. Other versions may also be affected.

SOLUTION: Restrict access to the service.

PROVIDED AND/OR DISCOVERED BY: Gabriel Silva