PT-2004-1020 · Jftpgw · Jftpgw

Publicado 2004-07-08 · Atualizado 2017-07-11 · CVE-2004-0448

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions jftpgw versions 0.13.4 and earlier

Description The issue concerns a format string vulnerability in the log function, allowing remote authenticated users to execute arbitrary code via format string specifiers in certain syslog messages. Additionally, there are multiple vulnerabilities in the jftpgw package that can lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For versions 0.13.4 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

BDU:2015-02972

CVE-2004-0448

DSA-510

Produtos afetados

Jftpgw

Referências · 7

• http://debian.org/security/dsa-510 · Nota
• http://securityfocus.com/bid/10438 · Aviso do Fabricante
• http://debian.org/security/2004/dsa-510 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0448 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16271 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0448 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02972 · Nota de Segurança