FTP: Bounce Attack

This protocol anomaly triggers when it detects an FTP bounce attack. There are two possibilities: a PORT command specified an IP address different from the client address, or a PASV command resulted in a 227 message with an IP address different than the server.

Extended Description

This problem is a design issue with the common implementation of the FTP protocol. In essence, the vulnerability is as follows: when a user FTP's into a host to retrieve files, the connection is two way (i.e. when you log in and request a file, the server then opens a connection back to your host of origin to deliver your requested data). Most FTP servers support what is called 'active mode' which allows users to specify a number of parameters to the FTP daemon. One of these is the PORT command, which lets you specify *where* you would like the return data connection to be sent. Therefore, instead of opening a connection back to yourself to drop off your requested files or data, you can then open that connection back to another host. This is true with both retrieving and putting data. Attackers can exploit this in some instances to circumvent access control, export restrictions, etc.

Affected Products

Digital unix

References

BugTraq: 126 50614

CVE: CVE-2010-1465

URL: http://www.cert.org/tech_tips/ftp_port_attacks.html http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/

Short Name

FTP:EXPLOIT:BOUNCE-ATTACK

Severity

Major

Recommended

False

Recommended Action

Drop

FTP: Bounce Attack

Extended Description

Affected Products

References

Found a potential security threat?