Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

WS_FTP SITE CPWD Buffer Overflow

Information

Severity

Severity

High

Family

Family

FTP

CVSSv2 Base

CVSSv2 Base

7.5

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Solution Type

Solution Type

Vendor Patch

Created

Created

18 years ago

Modified

Modified

5 years ago

Summary

This host is running a version of WS_FTP FTP server prior to 3.1.2.

Insight

Insight

Versions earlier than 3.1.2 contain an unchecked buffer in routines that handle the 'CPWD' command arguments. The 'CPWD' command allows remote users to change their password. By issuing a malformed argument to the CPWD command, a user could overflow a buffer and execute arbitrary code on this host. Note that a local user account is required.

Solution

Solution

The vendor has released a patch that fixes this issue. Please install the latest patch available from the vendor's website.

Common Vulnerabilities and Exposures (CVE)