Title: CVE-2019-9668 robinbhandari FTP remote DoS vulnerability Vulnerable: - https://github.com/rovinbhandari/FTP Description: robinbhandari is a open source tiny ftp server/client in github.com. it has a remote DoS vulnerability in a 'put' command. Timeline: 2019-03-11 CVE-2019-9668 robinbhandari FTP remote DoS vulnerability. 2019-03-10 my personal site advisory published. 2019-03-09 request CVE to mitre. (Report). 2019-02-27 vulnerability found. Details: hacker can set packet struct's datalen field variable. which is recv size from server side file transferring. then If set 0xffff(size of unsigned short) to datalen, put ./file then server side error occured and server will be closed. Vulnerable code: -------------------- FTP/file_transfer_functions.c [...] void receive_file(struct packet* hp, struct packet* data, int sfd, FILE* f) { [...] int x; int i = 0, j = 0; // (1) recved packet from ftp client. if((x = recv(sfd, data, size_packet, 0)) <= 0) er("recv()", x); j++; // (2) hp = struct packet * fields parsing. hp = ntohp(data); //printpacket(hp, HP); while(hp->type == DATA) // (3) If DATA type then enter here.. { i += fwrite(hp->buffer, 1, hp->datalen, f); // (4) x90c:: hacker can set hp->datalen, then server daemon error then remote DoS result occured. if((x = recv(sfd, data, size_packet, 0)) <= 0) er("recv()", x); j++; hp = ntohp(data); //printpacket(hp, HP); } [...] -------------------- PoC: we can change client_ftp.c to compile. Credit: x90c <x90chacker@gmail.com> - http://www.x90chacker.org.