CVE-2024-0261: Ftpdmin RNFR Command DoS Vulnerability

CVE-2024-0261 Overview

CVE-2024-0261 is a denial of service vulnerability in Sentex FTPDMIN version 0.96, a lightweight FTP server. The flaw resides in the RNFR (Rename From) command handler. A remote, unauthenticated attacker can send a malformed RNFR request to crash the service, disrupting file transfer availability for legitimate users. The weakness is categorized under [CWE-404] Improper Resource Shutdown or Release. Public exploit details have been disclosed through Packet Storm and VulDB under identifier VDB-249817.

Critical Impact
Unauthenticated remote attackers can terminate the FTPDMIN service over the network with a single crafted FTP command, eliminating file transfer availability.

Affected Products

Sentex FTPDMIN 0.96
FTP deployments exposing the RNFR command handler
Any service stack relying on FTPDMIN 0.96 for file transfer operations

Discovery Timeline

2024-01-07 - CVE-2024-0261 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0261

Vulnerability Analysis

The vulnerability is a network-reachable denial of service in the FTPDMIN 0.96 FTP server. An attacker connects to the FTP service and issues a manipulated RNFR command, which the server fails to process safely. The handler does not validate or properly release resources tied to the rename operation, causing the service process to terminate. No authentication, user interaction, or local access is required, and exploitation only affects availability — confidentiality and integrity remain intact.

The weakness falls under [CWE-404] Improper Resource Shutdown or Release. Public exploit disclosure was published through Packet Storm at FTPDMIN 0.96 Denial Of Service, and analysis is mirrored on VulDB #249817 Analysis.

Root Cause

The RNFR command handler in FTPDMIN 0.96 mishandles input passed during the rename operation. Because the handler does not gracefully release or recover from the malformed state, the server process terminates abnormally, leaving the FTP service unavailable until restarted.

Attack Vector

Exploitation occurs over the network on the FTP control channel (typically TCP/21). An attacker opens a session to the exposed FTPDMIN instance and submits a crafted RNFR command without needing valid credentials. A single malformed request is sufficient to crash the daemon. See VulDB #249817 Details for the public technical breakdown.

No verified code examples are available. The vulnerability mechanism is described in prose above; refer to the linked Packet Storm advisory for proof-of-concept details.

Detection Methods for CVE-2024-0261

Indicators of Compromise

Repeated FTP RNFR commands from a single source followed by abrupt loss of FTP service responsiveness
Unexpected termination or crash events for the FTPDMIN process in system logs
FTP connection resets immediately following a RNFR command on TCP/21
Inbound FTP traffic to hosts running FTPDMIN 0.96 from unknown external addresses

Detection Strategies

Inspect FTP server logs for RNFR commands containing unusually long, malformed, or non-printable arguments
Correlate FTPDMIN process exit events with preceding FTP control channel traffic
Use network IDS signatures that flag malformed RNFR payloads on the FTP control channel
Monitor for repeated short-lived TCP/21 sessions from the same source that precede service downtime

Monitoring Recommendations

Track FTPDMIN process uptime and alert on unscheduled restarts or crash loops
Capture full FTP command-channel telemetry and forward to a centralized log platform for correlation
Alert on inbound FTP connections from networks that do not require file transfer access

How to Mitigate CVE-2024-0261

Immediate Actions Required

Restrict inbound access to FTPDMIN services with firewall rules limiting TCP/21 to known clients
Take FTPDMIN 0.96 instances offline if they are exposed to untrusted networks
Migrate file transfer workloads to a maintained FTP, SFTP, or FTPS server
Monitor exposed instances for repeated RNFR commands and crash events

Patch Information

No vendor patch is referenced in the NVD entry for FTPDMIN 0.96. FTPDMIN is a legacy, minimally maintained FTP daemon, and no fixed version has been published in the available vendor resources. Operators should plan migration to an actively supported file transfer service.

Workarounds

Place FTPDMIN behind a VPN or jump host so that only authenticated users can reach the FTP control channel
Disable or block the RNFR command at an FTP-aware proxy if rename functionality is not required
Apply network segmentation to isolate FTPDMIN hosts from production and internet-facing zones
Implement automatic service supervision to restart the daemon after a crash while a permanent replacement is deployed

bash

# Example firewall restriction limiting FTPDMIN exposure to a trusted management subnet
iptables -A INPUT -p tcp --dport 21 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP