PT-2024-7379 · Unknown · Xlight Ftp Server
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Xlight FTP Server versions <3.9.4.3
Description
The issue exists due to an integer overflow error in the packet parsing logic of the SFTP server, which can lead to a heap overflow with attacker-controlled content. This can allow a remote attacker to execute arbitrary code by sending specially crafted SFTP packets. More than 3500 Xlight FTP servers are currently open on the internet and may be vulnerable to this remote code execution error.
Recommendations
For versions <3.9.4.3, update to version 3.9.4.3 or later to resolve the issue.
As a temporary workaround, consider restricting access to the SFTP server until a patch is applied.
Ensure that only trusted users have access to the server's service directories.
Exploit
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Xlight Ftp Server