CVE-2003-0466 Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands...
CriticalCVSS 9.8
EPSS 78.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat wu ftpd | = 2.6.1-16 | No fix listed |
| wuftpd wu-ftpd | >= 2.5.0, <= 2.6.2 | No fix listed |
| apple mac os x | = 10.2.6 | No fix listed |
| apple mac os x server | = 10.2.6 | No fix listed |
| freebsd | >= 4.0, <= 5.0 | No fix listed |
| netbsd | >= 1.5, <= 1.6.1 | No fix listed |
| OpenBSD | >= 2.0, <= 3.3 | No fix listed |
| sun solaris | = 9.0 | No fix listed |
References
- 20030731 wu-ftpd fb_realpath() off-by-one bug broken-link exploit mailing-list vendor-advisory
- IMNX-2003-7+-019-01 broken-link vendor-advisory
- isec.pl broken-link
- 20030731 wu-ftpd fb_realpath() off-by-one bug mailing-list
- FreeBSD-SA-03:08 mailing-list vendor-advisory
- 20030804 wu-ftpd-2.6.2 off-by-one remote exploit. mailing-list
- 20030804 Off-by-one Buffer Overflow Vulnerability in BSD libc realpath(3) mailing-list
- 9423 broken-link third-party-advisory
- 9446 broken-link third-party-advisory
- 9447 broken-link third-party-advisory
- 9535 broken-link third-party-advisory
- 1007380 broken-link third-party-advisory vdb-entry
- 1001257 broken-link vendor-advisory
- DSA-357 broken-link vendor-advisory
- VU#743092 third-party-advisory us-government-resource
- MDKSA-2003:080 third-party-advisory vendor-advisory
- SuSE-SA:2003:032 broken-link vendor-advisory
- 6602 broken-link vdb-entry
- RHSA-2003:245 broken-link vendor-advisory
- RHSA-2003:246 broken-link vendor-advisory
- 20060213 Latest wu-ftpd exploit :-s broken-link mailing-list third-party-advisory vdb-entry
- 20060214 Re: Latest wu-ftpd exploit :-s broken-link mailing-list third-party-advisory vdb-entry
- 8315 broken-link exploit patch third-party-advisory vdb-entry vendor-advisory
- TLSA-2003-46 broken-link vendor-advisory
- libc-realpath-offbyone-bo(12785) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:1970 broken-link signature vdb-entry