CVE-2004-0342 - WFTPD Pro Server 3.21 Release 1, with the XeroxDocutech option enabled, allows local users to cause

CVE-2004-0342

Summary

WFTPD Pro Server 3.21 Release 1, with the XeroxDocutech option enabled, allows local users to cause a denial of service (crash) via a (1) MKD or (2) XMKD command that causes an absolute path of 260 characters to be used, which overwrites a cookie with a null character, possibly due to an off-by-one error.

References

http://www.securityfocus.com/bid/9767
http://www.osvdb.org/4116
http://secunia.com/advisories/11001
http://marc.info/?l=bugtraq&m=107801142924976&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/15342

Vulnerable Configurations

cpe:2.3:a:wftpd_pro_server_project:wftpd_pro_server:3.21:r1:*:*:*:*:*:*
cpe:2.3:a:wftpd_pro_server_project:wftpd_pro_server:3.21:r1:*:*:*:*:*:*

CVSS

Base:	2.1 (as of 16-02-2024 - 20:44)
Impact:
Exploitability:

CWE

CWE-193

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:L/AC:L/Au:N/C:N/I:N/A:P

refmap via4

bid	9767
bugtraq	20040228 Multiple WFTPD Denial of Service vulnerabilities
osvdb	4116
secunia	11001
xf	wftpd-ftp-command-dos(15342)

Last major update

16-02-2024 - 20:44

Published

23-11-2004 - 05:00

Last modified

16-02-2024 - 20:44