PT-2014-6040 · Core Ftp · Core Ftp Le

Gabor Seljan · Publicado 2014-06-25 · Atualizado 2014-06-26 · CVE-2014-4643

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Core FTP LE version 2.2 build 1798

Description The issue is related to multiple heap-based buffer overflows in the client. This can be triggered by remote FTP servers sending a long string in response to certain commands, potentially causing a denial of service or allowing the execution of arbitrary code. The commands that can trigger this issue include USER, PASS, PASV, SYST, PWD, and CDUP.

Recommendations For Core FTP LE version 2.2 build 1798, consider avoiding the use of the affected commands until a patch is available. As a temporary workaround, restrict access to the FTP client to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2014-4643

Produtos afetados

Core Ftp Le

Referências · 6

• 🔥 http://exploit-db.com/exploits/33713 · Exploit
• 🔥 https://exploit-db.com/exploits/33713 · Exploit
• 🔥 http://packetstormsecurity.com/files/127075/Core-FTP-LE-2.2-Heap-Overflow.html · Exploit
• http://secunia.com/advisories/58818 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-4643 · Nota de Segurança
• http://osvdb.org/show/osvdb/108051 · Nota