bftpd NLST Command Output Format String

high Nessus Plugin ID 10568

Synopsis

The remote FTP server has a format string vulnerability.

Description

The remote FTP server, which appears to be Bftpd, has a format string vulnerability in the NLST command. A remote attacker could use this to crash the service, or possibly execute arbitrary code.

Solution

Upgrade to Bftpd 1.0.13 or later.

Plugin Details

Severity: High

ID: 10568

File Name: bftpd_format_string.nasl

Version: 1.42

Type: remote

Family: FTP

Published: 12/11/2000

Updated: 1/16/2024

Supported Sensors: Nessus

Risk Information

CVSS Score Rationale: Score from a more in depth analysis done by tenable

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: manual

CVSS v3

Risk Factor: High

Base Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Vulnerability Information

Vulnerability Publication Date: 12/6/2000

Detections

Analytics