PT-2004-1020 · Jftpgw · Jftpgw

Published 2004-07-08 · Updated 2017-07-11 · CVE-2004-0448

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions jftpgw versions 0.13.4 and earlier

Description The issue concerns a format string vulnerability in the log function, allowing remote authenticated users to execute arbitrary code via format string specifiers in certain syslog messages. Additionally, there are multiple vulnerabilities in the jftpgw package that can lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For versions 0.13.4 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-02972

CVE-2004-0448

DSA-510

Affected Products

Jftpgw

References · 7

• http://securityfocus.com/bid/10438 · Vendor Advisory
• http://debian.org/security/2004/dsa-510 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0448 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0448 · Security Note
• https://bdu.fstec.ru/vul/2015-02972 · Security Note
• http://debian.org/security/dsa-510 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16271 · Note