CVE-2008-5666
WinFTP FTP Server 2.3.0 - Authenticated Denial of Service via Invalid NLST Command
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2008-5666.
PoCs published by dmnt, Julien Bedard, including Metasploit module auxiliary/dos/windows/ftp/winftp230_nlst.
AI-analyzed exploit summary This exploit targets WinFTP v2.3.0 by sending a series of FTP commands, including a malformed 'NLST -1' command, to trigger a denial-of-service condition. The script repeatedly connects and sends these commands to ensure the DoS effect.
Description
WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to cause a denial of service via a sequence of FTP sessions that include an invalid "NLST -1" command.
Exploits (3)
This exploit targets WinFTP v2.3.0 by sending a series of FTP commands, including a malformed 'NLST -1' command, to trigger a denial-of-service condition. The script repeatedly connects and sends these commands to ensure the DoS effect.
This exploit targets a buffer overflow vulnerability in WinFTP Server 2.3.0 by sending an overly long argument to the NLST command, causing a denial of service (DoS). The script uses Perl and the Net::FTP module to connect and trigger the crash.
This Metasploit module exploits a denial-of-service vulnerability in WinFTP 2.3.0 by sending an overly long argument to the NLST command after establishing a PASV connection. The exploit requires valid authentication but can work with anonymous credentials if NLST permissions are granted.