CVE-2000-0574 FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function (sometimes called by set_proc_title), wh...
MediumCVSS 5.0
EPSS 58.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function (sometimes called by set_proc_title), which allows remote attackers to cause a denial of service or execute arbitrary commands.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenBSD ftpd | = 5.51 | No fix listed |
| OpenBSD ftpd | = 5.60 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta1 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr4 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr5 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr6 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr7 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr8 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr9 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr10 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr11 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr12 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr13 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr14 | No fix listed |
| washington university wu-ftpd | = 2.4.2_beta18_vr15 | No fix listed |
| washington university wu-ftpd | = 2.4.2_vr16 | No fix listed |
| washington university wu-ftpd | = 2.4.2_vr17 | No fix listed |
| washington university wu-ftpd | = 2.5 | No fix listed |
| washington university wu-ftpd | = 2.6 | No fix listed |
References
- 20000705 proftp advisory mailing-list
- 20000706 ftpd and setproctitle() mailing-list
- 20000710 opieftpd setproctitle() patches mailing-list
- CA-2000-13 patch third-party-advisory us-government-resource
- 1425 vdb-entry
- 1438 vdb-entry