critical10.0Public exploit code
CVE-2001-0187
Format string vulnerability in wu-ftp 2.6.1 and earlier, when running with debug mode enabled, allows remote attackers to execute arbitrary commands via a malf…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WU-FTPD 2.4.2/2.5/2.6 - Debug Mode Client Hostname Format String2001-01-23 · remote · unix · Verified
Impact
Format string vulnerability in wu-ftp 2.6.1 and earlier, when running with debug mode enabled, allows remote attackers to execute arbitrary commands via a malformed argument that is recorded in a PASV port assignment.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Washington University | Wu-Ftpd | Versions 2.4.1, 2.4.2_beta9, 2.4.2_beta18, 2.4.2_beta18_vr4, 2.4.2_beta18_vr5, 2.4.2_beta18_vr6 |
References
- NVD record
- CVE.org record
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000443
- http://www.debian.org/security/2001/dsa-016
- http://www.securityfocus.com/bid/2296
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6020
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000443
- http://www.debian.org/security/2001/dsa-016
- http://www.securityfocus.com/bid/2296
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6020