PT-2001-1478 · Oracle · Solaris

Published 2001-05-24 · Updated 2024-02-02 · CVE-2001-0249

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Solaris 8

Description The issue is related to a heap overflow in the FTP daemon, which allows remote attackers to execute arbitrary commands. This is achieved by creating a long pathname and calling the LIST command, which utilizes glob to generate long strings.

Recommendations For Solaris 8, consider disabling the FTP daemon until a patch is available to prevent exploitation. Restrict access to the LIST command to minimize the risk of arbitrary command execution. Avoid using long pathnames in the FTP daemon to reduce the risk of heap overflow.

Fix

Weakness Enumeration

CWE-131

Related Identifiers

CVE-2001-0249

Affected Products

Solaris

References · 6

• http://securityfocus.com/bid/2550 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0249 · Security Note
• http://nai.com/research/covert/advisories/048.asp · Vendor Advisory
• http://cert.org/advisories/CA-2001-07.html · Patch
• https://t.me/cvenotify/69686 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6332 · Note