Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.

Threat-Mapped Scoring

Score: 1.9

Priority: P3 - Important (Medium)

• S9 – Sabotage of System/App
• S10 – Denial of Service (+0.1 bonus)

EPSS

Score: 0.90825
Percentile: 0.996

CVSS Scoring

Mapped CWE(s)

• CWE-193 : Off-by-one Error

Affected Products

• cpe:2.3:a:redhat:wu_ftpd:2.6.1-16:*:*:*:*:*:*:*
• cpe:2.3:a:wuftpd:wu-ftpd:*:*:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.2.6:*:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x_server:10.2.6:*:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
• cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:*
• cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*
• cpe:2.3:o:sun:solaris:9.0:*:*:*:*:sparc:*:*

← Back to Home