PT-2010-1584 · Ipswitch · Ws Ftp Professional

Jeremy Brown · Published 2010-04-21 · Updated 2017-09-19 · CVE-2009-4775

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Ipswitch WS FTP Professional versions prior to 12.2

Description The issue allows remote attackers to cause a denial of service, resulting in a crash, by utilizing format string specifiers in the status code portion of an HTTP response.

Recommendations For versions prior to 12.2, update to version 12.2 or later to resolve the issue.

Exploit

Fix

DoS

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2009-4775

Affected Products

Ws Ftp Professional

References · 8

• 🔥 https://exploit-db.com/exploits/9607 · Exploit
• 🔥 http://securityfocus.com/bid/36297 · Exploit
• 🔥 http://exploit-db.com/exploits/9607 · Exploit
• 🔥 http://packetstormsecurity.org/0909-exploits/nocoolnameforawsftppoc.pl.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4775 · Security Note
• http://docs.ipswitch.com/WS_FTP%20122/ReleaseNotes/English/index.htm?k_id=ipswitch_com_ftp_documents_worldwide_ws_ftp122releasenotesenglish#link23 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53098 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4775 · Note