Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-18T20:17:09.933Z",
  "pubdate": "2026-09-18T20:17:09.933Z",
  "executiveSummary": "A vulnerability exists in the FTP service of IBM i versions 7.3, 7.4, 7.5, and 7.6, which could allow a local attacker to trigger a denial-of-service condition.\nThe issue stems from improper validation of FTP authentication commands processed by the system's FTP server implementation.\nBy submitting maliciously crafted authentication requests, an attacker can cause the FTP service to crash or become unresponsive, thereby denying legitimate users access to file transfer operations.\nThe vulnerability is limited to local attackers who possess the necessary permissions to interact with the FTP service.\nSuccessful exploitation results in service unavailability, potentially disrupting dependent business processes that rely on automated or manual FTP transfers.\nThere is no indication of remote exploitability; the threat profile requires the attacker to have an existing foothold on the host system or local console access.\nOrganizations should evaluate their reliance on the IBM i FTP service and ensure that access is restricted to authorized users only, while monitoring for service instability.",
  "technicalDetails": "The vulnerability is rooted in the input validation logic within the IBM i FTP server daemon, specifically during the handling and parsing of authentication-related commands.\nWhen a user attempts to authenticate via the FTP protocol, the system invokes specific internal functions to process credentials. Improper bounds checking or state management within these functions allows for the submission of anomalous data packets that the service fails to handle gracefully.\nThe attack flow begins with an authenticated or local user initiating an FTP session to the target IBM i host. The attacker then crafts specific FTP authentication commands—such as USER, PASS, or related authentication extensions—containing malformed strings or unexpected character sequences designed to trigger an exception during the parsing routine.\nIf the FTP server's validation logic does not correctly handle these malformed inputs, it can lead to an unhandled exception or memory corruption condition. This frequently results in the termination of the FTP server job (e.g., QTFTPD or related subsystems), effectively killing the process and preventing new connections or interrupting existing ones.\nAffected product versions include IBM i 7.3, 7.4, 7.5, and 7.6. The requirement for local access suggests that the attacker must have an existing local user profile on the IBM i system with sufficient authority to initiate an FTP session locally or via a local loopback interface.\nBecause the FTP daemon handles multiple sessions, a successful crash of the primary listener or the associated job handling the specific request can cause a system-wide denial of service for all FTP-dependent operations. The payload behavior is essentially non-persistent; it does not typically lead to remote code execution but forces a service restart requirement to restore availability.\nThe post-exploitation impact is strictly defined as a denial of service, as the service becomes unavailable until the relevant IBM i subsystem is manually restarted or recovered by system administrators. The lack of proper sanitization at the authentication stage is the primary architectural flaw identified in the FTP service's request handling pipeline."
}