PT-2004-1008 · Hsftp · Hsftp

Published 2004-03-15 · Updated 2017-10-10 · CVE-2004-0159

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions hsftp version 1.11

Description The issue allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via file names containing format string characters that are not properly handled when executing an "ls" command. Multiple vulnerabilities in the hsftp package may lead to breaches of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For hsftp version 1.11, consider restricting access to the "ls" command until a patch is available to prevent potential exploitation. As a temporary workaround, avoid using file names that contain format string characters to minimize the risk of denial of service or arbitrary code execution.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-01806

BDU:2015-01807

BDU:2015-01808

CVE-2004-0159

DSA-447

Affected Products

Hsftp

References · 12

• 🔥 https://exploit-db.com/exploits/23740 · Exploit
• https://bdu.fstec.ru/vul/2015-01806 · Security Note
• https://bdu.fstec.ru/vul/2015-01808 · Security Note
• https://debian.org/security/2004/dsa-447 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0159 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2004-0159 · Security Note
• http://securityfocus.com/bid/9715 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01807 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15276 · Note
• http://debian.org/security/dsa-447 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/017737.html · Note
• http://osvdb.org/4029 · Note