-
漏洞描述

Pablo FTP Server contains a flaw that may allow a remote denial of service. The issue is triggered when an attacker supplies a username containing format specifiers, and will result in loss of availability for the service. It is believed that execution of arbitrary code is possible as well.

-
时间线

公开日期:
2004-04-08

发现日期:
2002-10-15

利用日期:Unknow

解决日期:Unknow

-
解决方案

Upgrade to version 1.51 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by installing a filtering proxy that block requests containing format string markers.

-
不受影响的程序版本

-
漏洞讨论

A format string vulnerability has been reported in Pablo Software Solutions FTP Server. The vulnerability occurs due to inadequate checking of user-supplied input for the login credentials.

An attacker can exploit this vulnerability by logging into the FTP server with a username that includes malicious format specifiers. This may result in memory being overwritten by remote attackers, possibly to execute arbitrary code.

Attacker-supplied code will be executed with the privileges of the FTP server.

-
漏洞利用

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com &lt;mailto:vuldb@securityfocus.com&gt;.

-
解决方案

Pablo FTP Server 1.51 is not vulnerable to this issue. Users are advised to upgrade any vulnerable versions: