PT-2004-1017 · Lukemftp · Lukemftpd

Published 2004-08-19 · Updated 2017-07-11 · CVE-2004-0794

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions lukemftpd versions prior to 20040810

Description The issue concerns multiple vulnerabilities in the lukemftpd package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, signal handler race conditions in lukemftpd allow remote authenticated attackers to cause a denial of service or execute arbitrary code.

Recommendations For versions prior to 20040810, update to a version 20040810 or later to resolve the issue. As a temporary workaround, consider restricting access to the lukemftpd service to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-02950

CVE-2004-0794

DSA-551-1

Affected Products

Lukemftpd

References · 9

• https://bdu.fstec.ru/vul/2015-02950 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0794 · Security Note
• http://debian.org/security/2004/dsa-551 · Vendor Advisory
• http://vuxml.org/freebsd/c4b025bb-f05d-11d8-9837-000c41e2cdad.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0794 · Security Note
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-009.txt.asc · Vendor Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025418.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17020 · Note
• http://debian.org/security/dsa-551 · Note