| Vulnerability Name: | CVE-2003-0963 (CCN-13991) | ||||||||||||||||
| Assigned: | 2003-12-13 | ||||||||||||||||
| Published: | 2003-12-13 | ||||||||||||||||
| Updated: | 2017-10-11 | ||||||||||||||||
| Summary: | Buffer overflows in (1) try_netscape_proxy and (2) try_squid_eplf for lftp 2.6.9 and earlier allow remote HTTP servers to execute arbitrary code via long directory names that are processed by the ls or rels commands. | ||||||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||||||
| Vulnerability Type: | CWE-Other | ||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||
| References: | Source: SGI Type: UNKNOWN 20040101-01-U Source: SGI Type: UNKNOWN 20040202-01-U Source: CCN Type: VulnWatch Mailing List, Sat Dec 13 2003 - 17:20:16 CST lftp buffer overflows Source: MITRE Type: CNA CVE-2003-0963 Source: CCN Type: Conectiva Linux Security Announcement CLSA-2004:800 lftp Source: CCN Type: lftp Web site LFTP - reliable ftp client Source: BUGTRAQ Type: UNKNOWN 20031212 [slackware-security] lftp security update (SSA:2003-346-01) Source: BUGTRAQ Type: UNKNOWN 20031213 lftp buffer overflows Source: BUGTRAQ Type: UNKNOWN 20031217 [OpenPKG-SA-2003.053] OpenPKG Security Advisory (lftp) Source: BUGTRAQ Type: UNKNOWN 20031218 GLSA: lftp (200312-07) Source: CONECTIVA Type: UNKNOWN CLA-2004:800 Source: CCN Type: RHSA-2003-403 Updated lftp packages fix security vulnerability Source: CCN Type: RHSA-2003-404 lftp security update Source: SECUNIA Type: UNKNOWN 10525 Source: SECUNIA Type: UNKNOWN 10548 Source: CCN Type: CIAC Information Bulletin O-042 Red Hat 'lftp' Buffer Overflow Vulnerability Source: DEBIAN Type: UNKNOWN DSA-406 Source: DEBIAN Type: DSA-406 lftp -- buffer overflow Source: CCN Type: GLSA-200312-07 Two buffer overflows in lftp Source: CCN Type: Immunix Secured OS Security Advisory IMNX-2003-73-002-01 lftp Source: CCN Type: Fedora Security Update Notification FEDORA-2003-025 lftp Source: CCN Type: Gentoo Linux Security Announcement 200312-07 net-ftp/lftp Source: MANDRAKE Type: UNKNOWN MDKSA-2003:116 Source: SUSE Type: UNKNOWN SuSE-SA:2003:051 Source: CCN Type: OpenPKG-SA-2003.053 LFTP Source: REDHAT Type: UNKNOWN RHSA-2003:403 Source: REDHAT Type: UNKNOWN RHSA-2003:404 Source: CCN Type: SecuriTeam Mailing List, Security Holes & Exploits 13 Jan 2004 LFTP Remote Stack-Based Overflow Source: CCN Type: BID-9210 lftp Try_Netscape_Proxy Buffer Overflow Vulnerability Source: CCN Type: BID-9212 lftp Try_Squid_Eplf Buffer Overflow Vulnerability Source: CCN Type: Slackware Security Advisory SSA:2003-346-01 lftp security update Source: CCN Type: TLSA-2004-2 Buffer overflow Source: XF Type: UNKNOWN lftp-http-bo(13991) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:11180 Source: SUSE Type: SUSE-SA:2003:051 lftp: remote system compromise | ||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration RedHat 1:  Denotes that component is vulnerable | ||||||||||||||||
| Oval Definitions | |||||||||||||||||
| |||||||||||||||||
| BACK | |||||||||||||||||