high7.5Public exploit code
CVE-2004-0159
Format string vulnerability in hsftp 1.11 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via file names con…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Samhain Labs 1.x - HSFTP Remote Format String2004-02-23 · remote · linux · Verified
Impact
Format string vulnerability in hsftp 1.11 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via file names containing format string characters that are not properly handled when executing an "ls" command.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Samhain Labs | Hsftp | Versions 1.4, 1.5, 1.6, 1.7, 1.9, 1.10 |
References
- NVD record
- CVE.org record
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/017737.html
- http://www.osvdb.org/4029
- http://www.securityfocus.com/bid/9715
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15276
- https://www.debian.org/security/2004/dsa-447
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/017737.html
- http://www.osvdb.org/4029
- http://www.securityfocus.com/bid/9715
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15276
- https://www.debian.org/security/2004/dsa-447