Vulnerability · Published Jan 6, 2020 · Assigned by GitHub_M

CVE-2020-5204Buffer overflow vulnerability in uftpd

Medium 6.5

In plain English

A medium-severity stack buffer overflow in uftpd from troglobit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.1%top 34.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correct for valid IPv4 addresses (len('255.255.255.255') == 16), but the format specifier %d allows more than 3 digits. This has been fixed in version 2.11

Affected products (as reported)

Vendor	Product	Versions
troglobit	uftpd	< 2.11

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

References

https://github.com/troglobit/uftpd/security/advisories/GHSA-wrpr-xw7q-9wvq x_refsource_CONFIRM
https://github.com/troglobit/uftpd/commit/0fb2c031ce0ace07cc19cd2cb2143c4b5a63c9dd x_refsource_MISC
openSUSE-SU-2020:0069 vendor-advisory, x_refsource_SUSE