Rule release for today - September 1, 2009
Summary: The Microsoft FTP module for Internet Information Services contains a programming error that may let a remote attacker execute code by sending specially crafted directory names that trigger a stack-based buffer overflow. Sourcefire's VRT said previously released rules detect attacks on this vulnerability (GID 1, SIDs 1529, 1973, 2374 and 3441), the FTP Telnet preprocessor detects them as GID 125, SIDs 3, 6 and 8, and it added multiple rules to the web-activex, web-client, specific-threats, shellcode and bad-traffic rule sets.
What's compelling: A remote attacker who can reach an IIS FTP service may execute code on the host through nothing more than a crafted directory name, so the exposure sits on any internet-facing FTP endpoint still running the affected module.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026