ID CVE-2001-0248
Summary Buffer overflow in FTP server in HPUX 11 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the STAT command, which uses glob to generate long strings.
References
Vulnerable Configurations
  • cpe:2.3:o:sgi:irix:6.5.1:*:*:*:*:*:*:*
    cpe:2.3:o:sgi:irix:6.5.1:*:*:*:*:*:*:*
  • cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*
    cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*
  • cpe:2.3:o:sgi:irix:6.5.2:*:*:*:*:*:*:*
    cpe:2.3:o:sgi:irix:6.5.2:*:*:*:*:*:*:*
  • cpe:2.3:o:sgi:irix:6.5:*:*:*:*:*:*:*
    cpe:2.3:o:sgi:irix:6.5:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 02-02-2024 - 03:06)
Impact:
Exploitability:
CWE CWE-131
CAPEC
  • Buffer Overflow via Parameter Expansion
    In this attack, the target software is given input that the attacker knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an adversary. As a consequence, an adversary is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the adversaries' choice.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
refmap via4
bid 2552
cert CA-2001-07
nai 20010409 Globbing Vulnerabilities in Multiple FTP Daemons
xf ftp-glob-expansion(6332)
Last major update 02-02-2024 - 03:06
Published 18-06-2001 - 04:00
Last modified 02-02-2024 - 03:06
Back to Top