home | archive | books | download | about us | contact us

  Main Sections

About Us
Contact Us

Antivirus Software
Antivirus Updates
Firewall Software
Security Tools
  Microsoft Warnings

MS04-028 : Buffer Overrun in JPEG Processing (GDI+)
MS04-027 : Vulnerability in WordPerfect Converter
MS04-026 : Vulnerability in Exchange Server 5.5 Outlook Web Access
MS04-025 : Cumulative Security Update for IE
MS04-024 : Vulnerability in Windows Shell
MS04-023 : Vulnerability in HTML Help
MS04-022 : Vulnerability in Task Scheduler
MS04-021 : Security Update for IIS 4
MS04-020 : Vulnerability in POSIX
MS04-019 : Vulnerability in Utility Manager
  Sun Warnings

#220 Double Free bug in zlib compression library
#218 Bytecode Verifier
#217 Java Web Start
#216 HttpURLConnection
#215 snmpdx
#214 dtspcd
#213 login
#212 rpc.ttdbserverd
#211 xntpd

Denial-of-Service in IIS FTP Server 23 jul 1998

This issue involves a denial of service vulnerability that potentially can be used by someone with malicious intent to cause disruption of service. It cannot be used to crash the FTP server, or any other service running on the targeted system.

When multiple passive connections are made to a single FTP server via the PASV FTP command, it is possible to use up all available system threads for servicing clients. Once this happens, requests for additional connections will fail as discussed above, and will continue to fail until a client thread is again available. Further, the FTP and WWW services on a machine share a common thread pool, so exhausting the FTP thread pool also will cause connection requests for the WWW service to fail.

This vulnerability does not affect other services running on the same system, nor does it cause the FTP or WWW service to crash. Once the passive connections time out, the system performance will return to normal.

Server Administrators will see the following error in the System Event Log:

	   FTP Server could not create a client worker thread for user
	   at host 'IPAddress'. The connection to this user is terminated.
	   The data is the error.

Clients accessing either the WWW or FTP services might see messages such as the either of the following:

	 - Connection closed by remote host
	 - The FTP session was terminated

Fix for this problem

Fixes are avaiable at ftp://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/security/iis3-ftpfix/ for IIS3,

and ftp://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/security/iis4-ftpfix/ for IIS4.

© 1997-2012 Security-Solutions.net   All Rights Reserved.  Privacy Statement.