CVE-2019-25614 Free Float FTP 1.0 STOR Command Remote Buffer Overflow
CriticalCVSS 9.3
EPSS 0.98%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Free Float FTP 1.0 contains a buffer overflow vulnerability in the STOR command handler that allows remote attackers to execute arbitrary code by sending a crafted STOR request with an oversized payload. Attackers can authenticate with anonymous credentials and send a malicious STOR command containing 247 bytes of padding followed by a return address and shellcode to trigger code execution on the FTP server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freefloat Free Float FTP | = 1.0 | No fix listed |
| freefloat ftp server | = 1.0 | No fix listed |
References
- ExploitDB-46763 exploit third-party-advisory vdb-entry
- Product Reference broken-link product
- VulnCheck Advisory: Free Float FTP 1.0 STOR Command Remote Buffer Overflow third-party-advisory