CVE-2019-25686 Coreftp CVE debrief

Who should care

Users of Core FTP 2.0 build 653 should apply patches or mitigations to prevent denial of service attacks. Additionally, operators of FTP servers, platform administrators, and security teams should review the vulnerability details and assess their exposure. They should also consider implementing compensating controls, such as restricting FTP access, monitoring FTP server logs for suspicious activity, and tracking exceptions.

Technical summary

The vulnerability is caused by a buffer overflow in the PBSZ command handler of Core FTP 2.0 build 653. When a malformed PBSZ command with a payload exceeding 211 bytes is sent to the FTP server, it triggers an access violation and crashes the FTP server process. This issue can be exploited by unauthenticated attackers to cause a denial of service. The vendor has released a patched version of the software to address this vulnerability.

Defensive priority

High

Recommended defensive actions

• Apply patches or updates provided by the vendor
• Implement network access controls to restrict FTP access
• Monitor FTP server logs for suspicious activity
• Consider using alternative FTP software
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is documented in the NVD and CVE records. The vendor has released a patched version of the software. Evidence of exploitation has not been reported. However, defenders should verify that affected product deployments do not exist in managed environments. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, defenders should check relevant monitoring, detection, and logs for exposed assets that need extra review.

Official resources