CVE-2003-0466

CRITICAL

wu-ftpd <2.6.2 - RCE

Title source: llm

Description

Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.

Exploits (5)

exploitdb WORKING POC VERIFIED
by Xpl017Elz · cremotelinux
https://www.exploit-db.com/exploits/78
exploitdb WORKING POC VERIFIED
by Xpl017Elz · cremoteunix
https://www.exploit-db.com/exploits/22975
exploitdb WORKING POC VERIFIED
by Xpl017Elz · cremotelinux
https://www.exploit-db.com/exploits/74
exploitdb WORKING POC VERIFIED
by Xpl017Elz · cremoteunix
https://www.exploit-db.com/exploits/22974
exploitdb WORKING POC VERIFIED
by [email protected] · perlremotefreebsd
https://www.exploit-db.com/exploits/22976

Scores

CVSS v3 9.8
EPSS 0.9083
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-193
Status published
Products (8)
apple/mac_os_x 10.2.6
apple/mac_os_x_server 10.2.6
freebsd/freebsd 4.0 - 5.0
netbsd/netbsd 1.5 - 1.6.1
openbsd/openbsd 2.0 - 3.3
redhat/wu_ftpd 2.6.1-16
sun/solaris 9.0
wuftpd/wu-ftpd 2.5.0 - 2.6.2
Published Aug 27, 2003
Tracked Since Feb 18, 2026