Pure-FTPd ≤ 1.0.18 - DoS via Connection Limit Exhaustion

mediumseverity

5CVSS score

2.3%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

Pure-FTPd versions ≤ 1.0.18 are vulnerable to denial of service through connection limit exhaustion. The vulnerability occurs in the accept_client function when the maximum number of connections is exceeded, potentially causing the server to become unresponsive or crash.

Impact

Attackers can exhaust server connections by sending large numbers of simultaneous connection requests, causing Pure-FTPd to become unresponsive or crash.

Fix

Upgrade Pure-FTPd to version 1.0.19 or later that properly handles connection limit scenarios.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains(raw, 'Pure-FTPd') and compare_versions(version, '<= 1.0.18')

Run it with nuclei: nuclei -id CVE-2004-0656 -u <target>

The full check

id: CVE-2004-0656

info:
  name: Pure-FTPd ≤ 1.0.18 - DoS via Connection Limit Exhaustion
  author: pussycat0x
  severity: medium
  description: |
    Pure-FTPd versions ≤ 1.0.18 are vulnerable to denial of service through connection limit exhaustion. The vulnerability occurs in the accept_client function when the maximum number of connections is exceeded, potentially causing the server to become unresponsive or crash.
  impact: |
    Attackers can exhaust server connections by sending large numbers of simultaneous connection requests, causing Pure-FTPd to become unresponsive or crash.
  remediation: |
    Upgrade Pure-FTPd to version 1.0.19 or later that properly handles connection limit scenarios.
  reference:
    - http://www.pureftpd.org/
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/16611
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
    cvss-score: 5
    cve-id: CVE-2004-0656
    epss-score: 0.02329
    epss-percentile: 0.83668
    cpe: cpe:2.3:a:pureftpd:pureftpd:0.96:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: pureftpd
    product: pureftpd
    shodan-query: product:"Pure-FTPd" version:"1.0.14"
  tags: cve,cve2004,network,ftp,pure-ftpd,tcp,passive,vuln

tcp:
  - inputs:
      - data: 00000000
        type: hex

    host:
      - "{{Hostname}}"

    port: 21
    read-size: 1024

    matchers:
      - type: dsl
        dsl:
          - "contains(raw, 'Pure-FTPd')"
          - "compare_versions(version, '<= 1.0.18')"
        condition: and

    extractors:
      - type: regex
        group: 1
        name: version
        regex:
          - "Pure-FTPd ([0-9.]+)"

References

Use this check only on systems you are authorised to test. Where the data comes from