CVE-2000-0573 The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
HighCVSS 10.0
EPSS 96.2%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| HP Inc hp-ux | = 11.00 | No fix listed |
References
- 20000723 CONECTIVA LINUX SECURITY ANNOUNCEMENT - WU-FTPD (re-release) mailing-list
- 20000702 [Security Announce] wu-ftpd update mailing-list
- 20000622 WuFTPD: Providing *remote* root since at least1994 mailing-list
- 20000623 WUFTPD 2.6.0 remote root exploit mailing-list
- 20000707 New Released Version of the WuFTPD Sploit mailing-list
- CSSA-2000-020.0 vendor-advisory
- CA-2000-13 patch third-party-advisory us-government-resource
- RHSA-2000:039 vendor-advisory
- 1387 vdb-entry
- 20000623 ftpd: the advisory version mailing-list
- wuftp-format-string-stack-overwrite(4773) vdb-entry