CVE-2019-25686: Core FTP PBSZ Command DoS Vulnerability

CVE-2019-25686 Overview

CVE-2019-25686 is a denial of service vulnerability affecting Core FTP 2.0 build 653. The vulnerability exists in the PBSZ command handler, which fails to properly validate input length before processing. This allows unauthenticated attackers to crash the FTP server service by sending a malformed PBSZ command with an oversized buffer exceeding 211 bytes. When exploited, the vulnerability triggers an access violation that terminates the FTP server process, rendering the service unavailable.

Critical Impact

Unauthenticated remote attackers can crash the Core FTP Server service with a single malformed PBSZ command, causing complete denial of service for all connected users and pending file transfers.

Affected Products

• Core FTP 2.0 build 653
• CoreFTP Server (versions prior to security patch)

Discovery Timeline

• 2026-04-05 - CVE-2019-25686 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2019-25686

Vulnerability Analysis

The vulnerability stems from insufficient input validation in the PBSZ (Protection Buffer Size) command handler within Core FTP Server. The PBSZ command is part of the FTP Security Extensions (RFC 2228) and is used during FTP-SSL/TLS session negotiation to specify the maximum buffer size for protected data. In the affected version, the server fails to enforce proper boundary checks on the incoming PBSZ command parameter.

When a client sends a PBSZ command with a payload exceeding 211 bytes, the server attempts to process the oversized input without adequate bounds checking. This results in memory corruption that triggers an access violation exception, causing the FTP server process to crash immediately. The attack requires no authentication, as the PBSZ command can be issued before login credentials are provided.

Root Cause

The root cause is classified as CWE-306 (Missing Authentication for Critical Function), combined with improper input validation. The PBSZ command handler does not properly validate the length of the input buffer before processing, and the command is accessible without authentication. This design flaw allows any network-accessible attacker to send crafted commands that exceed the expected buffer size, leading to memory access violations.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can connect to the Core FTP Server on its listening port (typically TCP port 21) and immediately send a malicious PBSZ command without providing any credentials. The attack sequence involves:

1. Establishing a TCP connection to the FTP server
2. Sending a PBSZ command with a payload larger than 211 bytes
3. The server crashes due to access violation when processing the oversized buffer

The attack is trivial to execute and can be repeated to maintain denial of service conditions. Each successful attack terminates the FTP server process, requiring manual restart or automated recovery mechanisms.

Detection Methods for CVE-2019-25686

Indicators of Compromise

• FTP server process unexpectedly terminating with access violation errors
• Multiple connection attempts followed by immediate disconnection without successful authentication
• Abnormally large PBSZ command parameters in FTP logs (exceeding 211 bytes)
• Repeated service restarts for the Core FTP Server process

Detection Strategies

• Monitor FTP server logs for PBSZ commands with unusually large parameter values
• Implement network intrusion detection rules to identify oversized PBSZ command payloads
• Configure crash dump analysis to capture and analyze access violation events
• Deploy application-level firewall rules to validate FTP command parameter lengths

Monitoring Recommendations

• Enable verbose logging on Core FTP Server to capture all FTP commands
• Set up alerting for FTP service crashes or unexpected restarts
• Monitor network traffic for anomalous FTP command sequences from unauthenticated sources
• Implement availability monitoring to detect service outages quickly

How to Mitigate CVE-2019-25686

Immediate Actions Required

• Upgrade Core FTP Server to the latest available version that addresses this vulnerability
• Restrict network access to the FTP server using firewall rules to trusted IP ranges only
• Consider implementing a reverse proxy or load balancer with input validation capabilities
• Enable automatic service restart to minimize downtime from potential attacks

Patch Information

Organizations should upgrade Core FTP Server beyond build 653 to address this vulnerability. Refer to the CoreFTP Official Website for the latest available versions and security updates. Additional technical details are available in the VulnCheck Core FTP Advisory and Exploit-DB #46532.

Workarounds

• Implement network segmentation to limit exposure of the FTP server to trusted networks only
• Deploy a Web Application Firewall (WAF) or network-based intrusion prevention system to filter malformed FTP commands
• Configure firewall rules to rate-limit incoming FTP connections from single source IPs
• Consider disabling SSL/TLS FTP extensions if not required, as the PBSZ command is only relevant for secure FTP connections