CVE-2004-0255 Xlight 1.52, with log to screen enabled, allows remote attackers to cause a denial of service by requesting a long directory consisting of . (dot) and / (slash) characters, which causes the server to....
MediumCVSS 5.0
EPSS 7.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Xlight 1.52, with log to screen enabled, allows remote attackers to cause a denial of service by requesting a long directory consisting of . (dot) and / (slash) characters, which causes the server to crash when the administrator views the log file, possibly triggering a buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xlight ftp server | = 1.25 | No fix listed |
| xlight ftp server | = 1.41 | No fix listed |
| xlight ftp server | = 1.45 | No fix listed |
| xlight ftp server | = 1.52 | No fix listed |
References
- 20040205 Remote crash Xlight ftp server 1.52 mailing-list
- 9585 exploit vdb-entry vendor-advisory
- xlight-long-string-dos(15064) vdb-entry