CVE-2003-0466
CRITICALwu-ftpd 2.5.0-2.6.2 - Remote Code Execution via fb_realpath Off-by-one Error
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2003-0466. PoCs published by Xpl017Elz, [email protected].
AI-analyzed exploit summary This exploit targets an off-by-one vulnerability in wu-ftpd versions 2.6.0, 2.6.1, and 2.6.2, allowing remote code execution via a crafted directory name. It includes shellcode for Linux, FreeBSD, and OpenBSD to spawn a shell.
Description
Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.
Exploits (5)
This exploit targets an off-by-one vulnerability in wu-ftpd versions 2.6.0, 2.6.1, and 2.6.2, allowing remote code execution via a crafted directory name. It includes shellcode for Linux, FreeBSD, and OpenBSD to spawn a shell.
This exploit targets an off-by-one stack buffer overflow in the `realpath()` function in WU-FTPD versions 2.6.0-2.6.2, allowing remote code execution. It includes shellcode for Linux, FreeBSD, and OpenBSD, with brute-force and banner scanning capabilities.
This exploit targets an off-by-one vulnerability in wu-ftpd v2.6.2, allowing remote code execution via a crafted directory name. It includes shellcode for privilege escalation and a brute-force mode for targeting different Linux distributions.
This exploit targets an off-by-one stack buffer overflow in the `realpath()` function in WU-FTPD versions 2.6.0, 2.6.1, and 2.6.2, allowing remote code execution via a crafted directory name. It includes shellcode for privilege escalation and a reverse shell.
This exploit targets a stack-based buffer overflow in the 'realpath()' function in FreeBSD's libc, specifically affecting WU-FTPD. It uses a brute-force approach to guess the correct return address and offset to execute arbitrary shellcode, binding a shell on port 41254.
References (27)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H