PT-2019-15083 · Netsarang · Xftp Client

Published 2019-10-10 · Updated 2019-10-16 · CVE-2019-17320

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NetSarang XFTP Client versions 6.0149 and earlier

Description The issue is caused by improper boundary checks when copying file names from an attacker-controlled FTP server, leading to a buffer overflow. This allows an attacker to execute arbitrary code by sending a crafted filename.

Recommendations For versions 6.0149 and earlier, update to a version that contains a fix for this issue, as using a crafted filename can lead to arbitrary code execution.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

CVE-2019-17320

Affected Products

Xftp Client

References · 3

• https://osv.dev/vulnerability/CVE-2019-17320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17320 · Security Note
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35160 · Note