PT-2003-1977 · Lftp · Lftp

Ulf Härnhammar · Publicado 2003-12-17 · Atualizado 2017-10-11 · CVE-2003-0963

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions lftp versions 2.6.9 and earlier

Description The issue concerns buffer overflows in the try netscape proxy and try squid eplf functions for lftp. Remote HTTP servers can execute arbitrary code via long directory names that are processed by the ls or rels commands.

Recommendations For lftp versions 2.6.9 and earlier, update to a version later than 2.6.9 to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2003-0963

DSA-406

RHSA-2003:404

Produtos afetados

Lftp

Referências · 20

• 🔥 https://exploit-db.com/exploits/143 · Exploit
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11180 · Nota
• http://novell.com/linux/security/advisories/2003_051_lftp.html · Aviso do Fabricante
• ftp://patches.sgi.com/support/free/security/advisories/20040101-01-U · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=107167974714484&w=2 · Nota
• http://redhat.com/support/errata/RHSA-2003-403.html · Aviso do Fabricante
• http://secunia.com/advisories/10525 · Nota
• http://secunia.com/advisories/10548 · Nota
• http://marc.info/?l=bugtraq&m=107126386226196&w=2 · Nota
• https://security-tracker.debian.org/tracker/CVE-2003-0963 · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2003-404.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2003-0963 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0963 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=107152267121513&w=2 · Nota
• http://marc.info/?l=bugtraq&m=107340499504411&w=2 · Aviso do Fabricante