FileZilla Server < 0.9.31 - SSL/TLS Packet Overflow DoS

mediumseverity

4.3CVSS score

3.4%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

FileZilla Server versions prior to 0.9.31 contain a buffer overflow vulnerability related to SSL/TLS packet handling. This vulnerability allows remote attackers to cause a denial of service through unspecified vectors involving SSL/TLS packets.

Impact

Unauthenticated attackers can send specially crafted SSL/TLS packets to trigger buffer overflow, causing denial of service by crashing the FileZilla FTP server.

Fix

Update FileZilla Server to version 0.9.31 or later that properly handles SSL/TLS packet processing and prevents buffer overflow vulnerabilities.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains(raw, 'FileZilla') and compare_versions(version, '< 0.9.31')

Run it with nuclei: nuclei -id CVE-2009-0884 -u <target>

The full check

id: CVE-2009-0884

info:
  name: FileZilla Server < 0.9.31 - SSL/TLS Packet Overflow DoS
  author: pussycat0x
  severity: medium
  description: |
    FileZilla Server versions prior to 0.9.31 contain a buffer overflow vulnerability related to SSL/TLS packet handling. This vulnerability allows remote attackers to cause a denial of service through unspecified vectors involving SSL/TLS packets.
  impact: |
    Unauthenticated attackers can send specially crafted SSL/TLS packets to trigger buffer overflow, causing denial of service by crashing the FileZilla FTP server.
  remediation: |
    Update FileZilla Server to version 0.9.31 or later that properly handles SSL/TLS packet processing and prevents buffer overflow vulnerabilities.
  reference:
    - http://sourceforge.net/project/shownotes.php?release_id=665428
    - http://www.vupen.com/english/advisories/2009/0603
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/49107
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:P
    cvss-score: 4.3
    cve-id: CVE-2009-0884
    cwe-id: CWE-120
    epss-score: 0.03421
    epss-percentile: 0.89009
    cpe: cpe:2.3:a:filezilla-project:filezilla_server:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: filezilla-project
    product: filezilla_server
    shodan-query: product:"FileZilla"
  tags: cve,cve2009,network,ftp,filezilla,tcp,passive,vuln

tcp:
  - inputs:
      - data: 00000000
        type: hex

    host:
      - "{{Hostname}}"

    port: 21
    read-size: 1024

    matchers:
      - type: dsl
        dsl:
          - "contains(raw, 'FileZilla')"
          - "compare_versions(version, '< 0.9.31')"
        condition: and

    extractors:
      - type: regex
        group: 1
        name: version
        regex:
          - "FileZilla Server version ([0-9.]+)"

References

Use this check only on systems you are authorised to test. Where the data comes from