PT-2006-1181 · Nico · Nicoftp

K4P0 · Published 2006-01-06 · Updated 2018-10-19 · CVE-2006-0100

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: NicoFTP versions 3.0.1.19 and earlier

Description: A buffer overflow issue might allow local users to execute arbitrary code via a long string in the Name of site field of an FTP account. However, since the program executes with the privileges of the invoking user and remote programs do not normally have the ability to create or modify FTP accounts, there may not be a typical attack vector for the issue that crosses privilege boundaries.

Recommendations: For NicoFTP versions 3.0.1.19 and earlier, consider restricting the length of the string in the Name of site field to prevent potential buffer overflow issues. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2006-0100

Affected Products

Nicoftp

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2006-0100 · Security Note
• http://securityreason.com/securityalert/317 · Note
• http://securityfocus.com/archive/1/420670/100/0/threaded · Note