PT-2003-1036 · Xfstt · Xfstt

Vade79 · Published 2003-08-01 · Updated 2024-02-15 · CVE-2003-0625

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions xfstt (affected versions not specified)

Description The issue is related to an off-by-one error in xfstt, allowing remote attackers to read potentially sensitive memory via a malformed client request in the connection handshake. This can lead to a leak of memory in the server's response, potentially compromising confidentiality. Multiple vulnerabilities in the xfstt package may also lead to disruptions in the integrity and availability of protected information, with exploitation possible remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-193

Related Identifiers

BDU:2015-04058

CVE-2003-0625

DSA-360

Affected Products

Xfstt

References · 14

• 🔥 http://marc.info/?l=bugtraq&m=105941103709264&w=2 · Exploit
• 🔥 https://exploit-db.com/exploits/22952 · Exploit
• 🔥 http://securityfocus.com/bid/8255 · Exploit
• https://bdu.fstec.ru/vul/2015-04058 · Security Note
• http://debian.org/security/2003/dsa-360 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0625 · Security Note
• https://osv.dev/vulnerability/CVE-2003-0625 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0625 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0581 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2003-0625 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0625 · Security Note
• http://debian.org/security/dsa-360 · Note
• http://developer.berlios.de/forum/forum.php?forum_id=2819 · Note
• https://t.me/cvenotify/71669 · Telegram Post