CVE-2004-2082 in Sami FTP Server
Summary
by MITRE
The samiftp.dll library in Sami FTP Server 1.1.3 allows remote authenticated users to cause a denial of service (pmsystem.exe crash) via a GET request wit a large number of leading "/" (slash) characters.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2025
The vulnerability identified as CVE-2004-2082 resides within the samiftp.dll library component of Sami FTP Server version 1.1.3, representing a classic denial of service flaw that exploits improper input validation mechanisms. This vulnerability specifically targets the handling of GET requests within the FTP server implementation, where the system fails to adequately process or sanitize path traversal sequences containing an excessive number of leading forward slash characters. The flaw manifests when authenticated remote users submit maliciously crafted GET requests that contain numerous consecutive forward slash characters at the beginning of the requested file path, ultimately causing the pmsystem.exe process to crash and terminate unexpectedly. The root cause of this vulnerability aligns with CWE-129, which addresses improper validation of input boundaries, and more specifically with CWE-400, concerning the lack of proper input sanitization leading to resource exhaustion or system instability. This issue operates under the broader category of buffer overflows or input processing errors that can be exploited to disrupt service availability.
The operational impact of this vulnerability extends beyond simple service disruption, as it represents a significant security weakness that can be leveraged by malicious actors to systematically degrade the availability of the FTP service. When an authenticated user submits a GET request containing an excessive number of leading slash characters, the samiftp.dll library processes this input without proper boundary checks, leading to a condition where the internal path parsing mechanism becomes overwhelmed or encounters an invalid state that triggers the pmsystem.exe crash. This behavior creates a reliable denial of service vector that can be repeatedly exploited to maintain service unavailability, making it particularly dangerous in environments where continuous FTP service availability is critical. The vulnerability demonstrates characteristics consistent with the ATT&CK technique T1499.004, which involves network denial of service attacks through the exploitation of service vulnerabilities. The exploitation requires only basic authentication credentials, making it accessible to users who have legitimate access to the FTP server but could potentially abuse this privilege to cause service disruption.
Mitigation strategies for this vulnerability should focus on implementing proper input validation and boundary checking within the FTP server's path handling routines. The most effective immediate solution involves patching the samiftp.dll library to enforce reasonable limits on the number of leading slash characters allowed in file path requests, ensuring that the system can process these inputs without triggering crashes. System administrators should also implement network-level monitoring to detect unusual patterns of GET requests containing excessive leading slashes, which could indicate attempted exploitation of this vulnerability. Additionally, configuring the FTP server to limit the maximum path depth or length of file requests can provide defense in depth against similar vulnerabilities. The implementation of proper error handling and graceful degradation mechanisms within the pmsystem.exe process would also help prevent complete service crashes when malformed input is encountered. Organizations should also consider implementing access controls and rate limiting to prevent abuse of authenticated sessions, while maintaining regular vulnerability assessments to identify similar input validation weaknesses in other components of their FTP infrastructure. This vulnerability highlights the importance of input sanitization and boundary checking in network services, as outlined in security best practices and standards such as those defined by the Open Web Application Security Project and NIST guidelines for secure coding practices.