CVE-2009-2521
EXPLOITED RANSOMWAREMicrosoft Internet Information Services 5.0-7.0 - Authenticated Denial of Service via FTP List Command
Title source: llmExploitation Summary
CVE-2009-2521 has been observed exploited in the wild (reported by VulnCheck KEV), including in ransomware campaigns.
EIP tracks 3 public exploits from researchers including kingcope, Myo Soe, Kingcope, Myo Soe, including a Metasploit module auxiliary/dos/windows/ftp/iis_list_exhaustion.
AI-analyzed exploit summary This exploit demonstrates a Denial of Service (DoS) vulnerability in Microsoft IIS FTPD versions 5.0 and 6.0. The vulnerability is triggered by sending a malformed 'ls' command with a recursive globbing pattern, causing a stack overflow and crashing the FTP service.
Description
Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory, followed by a .. (dot dot), aka "IIS FTP Service DoS Vulnerability."
Exploits (3)
This exploit demonstrates a Denial of Service (DoS) vulnerability in Microsoft IIS FTPD versions 5.0 and 6.0. The vulnerability is triggered by sending a malformed 'ls' command with a recursive globbing pattern, causing a stack overflow and crashing the FTP service.
This exploit triggers a stack exhaustion denial-of-service (DoS) in Microsoft IIS FTP Server versions 5.0 through 7.0 by sending a crafted LIST command with a wildcard. It requires valid FTP credentials and checks for the presence of a directory, creating one if necessary.
This Metasploit module exploits a stack exhaustion vulnerability in Microsoft IIS FTP Server (5.0-7.0) via a crafted LIST command with wildcards, leading to a Denial of Service (DoS). It requires valid FTP credentials and checks for directory existence, creating one if necessary.