PT-2007-3097 · Hewlett Packard · Hpaftpd

Published 2007-03-28 · Updated 2017-07-29 · CVE-2007-1731

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: hpaftpd version 1.01

Description: The issue is related to multiple stack-based buffer overflows that allow remote attackers to execute arbitrary code. This can be achieved by providing long arguments to various FTP commands, including the USER, PASS, CWD, MKD, RMD, DELE, RNFR, and RNTO commands.

Recommendations: For hpaftpd version 1.01, consider restricting access to the FTP server until a patch is available, and avoid using long arguments with the mentioned FTP commands to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-1731

Affected Products

Hpaftpd

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-1731 · Security Note
• http://securiteam.com/securitynews/5AP0L1PKUU.html · Note
• http://securityfocus.com/bid/23147 · Note
• http://vupen.com/english/advisories/2007/1142 · Note
• http://osvdb.org/35182 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33288 · Note