CVE-2004-1675 in Serv-U FTP Server
Summary
by MITRE
Serv-U FTP server 4.x and 5.x allows remote attackers to cause a denial of service (application crash) via a STORE UNIQUE (STOU) command with an MS-DOS device name argument such as (1) COM1, (2) LPT1, (3) PRN, or (4) AUX.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/06/2025
The vulnerability identified as CVE-2004-1675 affects Serv-U FTP server versions 4.x and 5.x, presenting a significant denial of service risk that can be exploited by remote attackers. This flaw specifically targets the server's handling of file storage operations, particularly when processing the STORE UNIQUE command with malformed device name arguments. The vulnerability stems from the server's inadequate input validation and improper handling of special MS-DOS device names that are reserved for system operations. These device names including COM1, LPT1, PRN, and AUX represent legacy system interfaces that should not be accessible through standard file operations, yet the vulnerable Serv-U implementation fails to properly sanitize or reject such inputs during file transfer processes.
The technical exploitation of this vulnerability occurs when an attacker sends a STORE UNIQUE command with one of the specified device names as an argument. The FTP server processes this command without adequate validation, leading to a critical system failure that results in application crash and subsequent denial of service for legitimate users. This flaw operates at the protocol level within the FTP server implementation, specifically in how it interprets and processes file naming conventions during upload operations. The vulnerability is classified under CWE-20 as "Improper Input Validation" and represents a classic case of inadequate sanitization of user-supplied data before system operations are performed. The attack vector is remote and requires no authentication, making it particularly dangerous as it can be exploited by anyone with network access to the affected FTP server.
The operational impact of this vulnerability extends beyond simple service disruption, as it can compromise the availability of critical file transfer services within organizations that rely on Serv-U FTP servers. When exploited successfully, the application crash can result in complete service unavailability until the server is manually restarted, potentially causing significant business disruption. The vulnerability affects organizations that have not updated their FTP server software, particularly those with legacy systems that may be difficult to patch or replace. From an adversary perspective, this represents a low-effort, high-impact attack that aligns with ATT&CK technique T1499.100 for "Endpoint Denial of Service" and T1566.001 for "Phishing with Malicious Attachment" when considering how attackers might use such vulnerabilities to disrupt services. The vulnerability's exploitation can also serve as a precursor to more sophisticated attacks, as service disruption often creates opportunities for further exploitation.
Organizations should immediately implement mitigations including updating to patched versions of Serv-U FTP server software, implementing network segmentation to limit access to FTP services, and deploying intrusion detection systems to monitor for suspicious FTP command sequences. The recommended approach involves applying vendor security patches that address the input validation issues in the STORE UNIQUE command handling, as well as implementing proper access controls to restrict FTP service exposure. Network administrators should consider implementing firewall rules that limit access to FTP services to trusted IP ranges and monitor for unusual command patterns that might indicate exploitation attempts. Additionally, organizations should conduct regular security assessments of their file transfer infrastructure to identify and remediate similar vulnerabilities that may exist in other legacy systems. The vulnerability demonstrates the importance of proper input sanitization and the potential for legacy system components to introduce security risks that can be exploited remotely without authentication.