Home page logo

bugtraq logo Bugtraq mailing list archives

Re: FTP denial of service attack
From: hno () HEM PASSAGEN SE (Henrik Nordstrom)
Date: Wed, 8 Dec 1999 01:26:42 +0100

Darren Reed wrote:

ftpd's which limit connections to 1 per user () host or similar may have some
defense against this, or if they don't support multiple data connections
open at the same time.

FTP does NOT support multiple data channels. The standard says that the
server MUST close the previous connection if the user agent initiates a
new channel (by using PORT/PASV). All FTP servers I have tried does

This attack is a TCP FIN_WAIT2 attack. I.e. it is more of an TCP DOS
than an FTP DOS. Any TCP service which accepts unlimited rate of
connections can be attacked in this way if you can affort (or spoof) to
have that number of TCP connection open. The main difference from other
FIN_WAIT2 attacks is that the FTP service usually does not log each
individual data channel connection, making it hard to locate once the
attacker has closed down the attack.

Henrik Nordstrom

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]