2
3
I noticed that not all FTPS clients support session reuse and I'm wondering whether it is a critical security option that should be left enabled on the server.
My guess is that it's possible for an attacker to hijack the data connection even if SSL/TLS is used for both control and data connection, if the session reuse option is not enabled. Could anyone help confirm/disprove this and give more detailed explanations?
I also found this: VU#2558 File Transfer Protocol allows data connection hijacking via PASV mode race condition, not knowing if it's relevant since it doesn't mention SSL/TLS at all.