OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq Archives: Re: FTP denial of service attack

Re: FTP denial of service attack

Subject: Re: FTP denial of service attack
From: Henrik Nordstrom (hnoHEM.PASSAGEN.SE)
Date: Tue Dec 07 1999 - 18:26:42 CST

Darren Reed wrote:

> ftpd's which limit connections to 1 per userhost or similar may have some
> defense against this, or if they don't support multiple data connections
> open at the same time.

FTP does NOT support multiple data channels. The standard says that the
server MUST close the previous connection if the user agent initiates a
new channel (by using PORT/PASV). All FTP servers I have tried does
this.

This attack is a TCP FIN_WAIT2 attack. I.e. it is more of an TCP DOS
than an FTP DOS. Any TCP service which accepts unlimited rate of
connections can be attacked in this way if you can affort (or spoof) to
have that number of TCP connection open. The main difference from other
FIN_WAIT2 attacks is that the FTP service usually does not log each
individual data channel connection, making it hard to locate once the
attacker has closed down the attack. 

--
Henrik Nordstrom

This archive was generated by hypermail 2b27 : Wed Dec 08 1999 - 21:27:24 CST