Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2003-0466 — Off-by-one Error in Wu-ftpd

CWE-193 — Off-by-one Error15 documents8 sources
Severity
9.8CRITICALNVD
EPSS
90.8%
top 0.37%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
8
FreebsdNetbsdOpenbsd+5 more
Timeline
PublishedAug 27
Latest updateMay 3

Description

Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages8 packages

▶NVDwuftpd/wu-ftpd2.5.0 — 2.6.2
▶NVDredhat/wu_ftpd2.6.1-16
▶NVDnetbsd/netbsd1.5 — 1.6.1
▶NVDfreebsd/freebsd4.0 — 5.0
▶NVDopenbsd/openbsd2.0 — 3.3

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-7c4w-gm97-vgqq: Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demons↗2022-05-03
▶
CVEList
CVE-2003-0466: Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demons↗2003-08-01
▶

💥Exploits & PoCs

5
Exploit-DB
WU-FTPD 2.6.2 - Remote Command Execution↗2003-08-11
▶
Exploit-DB
WU-FTPD 2.6.0/2.6.1/2.6.2 - 'realpath()' Off-by-One Buffer Overflow↗2003-08-06
▶
Exploit-DB
WU-FTPD 2.6.2 - Off-by-One Remote Command Execution↗2003-08-03
▶
Exploit-DB
WU-FTPD 2.6.2 - 'realpath()' Off-by-One Buffer Overflow↗2003-08-02
▶
Exploit-DB
FreeBSD 4.8 - 'realpath()' Off-by-One Buffer Overflow↗2003-07-31
▶

🔍Detection Rules

4
Suricata
GPL FTP STOU overflow attempt↗2010-09-23
▶
Suricata
GPL FTP RETR overflow attempt↗2010-09-23
▶
Suricata
GPL FTP APPE overflow attempt↗2010-09-23
▶
Suricata
GPL FTP RNTO overflow attempt↗2010-09-23
▶

📋Vendor Advisories

1
Red Hat
security flaw↗2003-07-31
▶

📐Framework References

1
CWE
Off-by-one Error↗
▶

💬Community

1
Bugzilla
CVE-2003-0466 security flaw↗2018-08-16
▶
CVE-2003-0466 — Off-by-one Error in Wuftpd Wu-ftpd | cvebase