uftpd up to 2.10 ftpcmd.c handle_PORT stack-based overflow

entryeditHistoryDiffjsonxmlCTI

A vulnerability was found in uftpd up to 2.10 (File Transfer Software) and classified as critical. This issue affects the function handle_PORT of the file ftpcmd.c. Upgrading to version 2.11 eliminates this vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

Field

Commit Conf

Approve Conf

ID	Commited	User	Field	Change	Remarks	Moderated	Reason	C
9704788	01/07/2020	VulD...	cve_nvd_summary	In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correct for valid IPv4 addresses (len('255.255.255.255') == 16), but the format specifier %d allows more than 3 digits. This has been fixed in version 2.11	mitre.org	01/07/2020	accepted	100
9704787	01/07/2020	VulD...	cve_assigned	1577923200	mitre.org	01/07/2020	accepted	100
9704779	01/07/2020	VulD...	cvss3_nvd_a	L	nist.gov	01/07/2020	accepted	100
9704778	01/07/2020	VulD...	cvss3_nvd_i	L	nist.gov	01/07/2020	accepted	100
9704777	01/07/2020	VulD...	cvss3_nvd_c	L	nist.gov	01/07/2020	accepted	100
9704776	01/07/2020	VulD...	cvss3_nvd_s	C	nist.gov	01/07/2020	accepted	100
9704775	01/07/2020	VulD...	cvss3_nvd_ui	R	nist.gov	01/07/2020	accepted	100
9704774	01/07/2020	VulD...	cvss3_nvd_pr	L	nist.gov	01/07/2020	accepted	100
9704773	01/07/2020	VulD...	cvss3_nvd_ac	L	nist.gov	01/07/2020	accepted	100
9704772	01/07/2020	VulD...	cvss3_nvd_av	N	nist.gov	01/07/2020	accepted	100
9704750	01/07/2020	VulD...	cwe	121 (memory corruption)		01/07/2020	accepted	100
9704745	01/07/2020	VulD...	type	File Transfer Software		01/07/2020	accepted	100
9704795	01/07/2020	VulD...	cvss3_nvd_basescore	6.5	nist.gov	01/07/2020	accepted	90
9704794	01/07/2020	VulD...	cvss3_vuldb_rc	U		01/07/2020	accepted	90
9704793	01/07/2020	VulD...	cvss3_vuldb_rl	O		01/07/2020	accepted	90
9704792	01/07/2020	VulD...	cvss3_vuldb_e	X		01/07/2020	accepted	90
9704791	01/07/2020	VulD...	cvss2_vuldb_rc	UC		01/07/2020	accepted	90
9704790	01/07/2020	VulD...	cvss2_vuldb_rl	OF		01/07/2020	accepted	90
9704789	01/07/2020	VulD...	cvss2_vuldb_e	ND		01/07/2020	accepted	90
9704786	01/07/2020	VulD...	cve	CVE-2020-5204	mitre.org	01/07/2020	accepted	100