PT-2014-6040 · Core Ftp · Core Ftp Le

Gabor Seljan · Published 2014-06-25 · Updated 2014-06-26 · CVE-2014-4643

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Core FTP LE version 2.2 build 1798

Description The issue is related to multiple heap-based buffer overflows in the client. This can be triggered by remote FTP servers sending a long string in response to certain commands, potentially causing a denial of service or allowing the execution of arbitrary code. The commands that can trigger this issue include USER, PASS, PASV, SYST, PWD, and CDUP.

Recommendations For Core FTP LE version 2.2 build 1798, consider avoiding the use of the affected commands until a patch is available. As a temporary workaround, restrict access to the FTP client to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-4643

Affected Products

Core Ftp Le

References · 6

• 🔥 http://exploit-db.com/exploits/33713 · Exploit
• 🔥 https://exploit-db.com/exploits/33713 · Exploit
• 🔥 http://packetstormsecurity.com/files/127075/Core-FTP-LE-2.2-Heap-Overflow.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4643 · Security Note
• http://secunia.com/advisories/58818 · Note
• http://osvdb.org/show/osvdb/108051 · Note