PT-2004-1494 · Texas Imperial · Wftpd Server+1

Axl · Published 2004-03-18 · Updated 2017-07-11 · CVE-2004-0340

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WFTPD Pro Server versions 3.21 Release 1 through 3.21 Release 1 WFTPD Pro Server version 3.20 Release 2 WFTPD Server versions 3.21 Release 1 through 3.21 Release 1 WFTPD Server version 3.10

Description A stack-based buffer overflow issue allows local users to execute arbitrary code via long commands, including LIST, NLST, or STAT commands.

Recommendations For WFTPD Pro Server version 3.21 Release 1, consider disabling the execution of long LIST, NLST, or STAT commands until a patch is available. For WFTPD Pro Server version 3.20 Release 2, restrict access to the LIST, NLST, and STAT commands to minimize the risk of exploitation. For WFTPD Server version 3.21 Release 1, avoid using long commands in the affected server until the issue is resolved. For WFTPD Server version 3.10, consider applying configuration changes to limit the length of incoming commands. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-0340

Affected Products

Wftpd Pro Server

Wftpd Server

References · 6

• 🔥 https://exploit-db.com/exploits/159 · Exploit
• 🔥 http://securityfocus.com/bid/9767 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0340 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15340 · Note
• http://secunia.com/advisories/11001 · Note
• http://marc.info/?l=bugtraq&m=107801208004699&w=2 · Note