20031212 [slackware-security] lftp security update (SSA:2003-346-01)mailing list
http://marc.info/?l=bugtraq&m=107126386226196&w=2 CVE-2003-0963
lftp 2.6.9 - Remote Stack Overflow
Record summary
CVE-2003-0963 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.
Description
Buffer overflows in (1) try_netscape_proxy and (2) try_squid_eplf for lftp 2.6.9 and earlier allow remote HTTP servers to execute arbitrary code via long directory names that are processed by the ls or rels commands.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBlftp 2.6.9 - Remote Stack OverflowExploitDB exploitby Li0n7Not analyzed1 file
References
Showing 12 of 1420031213 lftp buffer overflowsmailing list
http://marc.info/?l=bugtraq&m=107152267121513&w=2 20031217 [OpenPKG-SA-2003.053] OpenPKG Security Advisory (lftp)mailing list
http://marc.info/?l=bugtraq&m=107167974714484&w=2 20031218 GLSA: lftp (200312-07)mailing list
http://marc.info/?l=bugtraq&m=107177409418121&w=2 CLA-2004:800Vendor advisory
http://marc.info/?l=bugtraq&m=107340499504411&w=2 10525Third-party advisory
http://secunia.com/advisories/10525 10548Third-party advisory
http://secunia.com/advisories/10548 DSA-406Vendor advisory
http://www.debian.org/security/2004/dsa-406 MDKSA-2003:116Vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2003:116 SuSE-SA:2003:051Vendor advisory
http://www.novell.com/linux/security/advisories/2003_051_lftp.html RHSA-2003:403Vendor advisory
http://www.redhat.com/support/errata/RHSA-2003-403.html RHSA-2003:404Vendor advisory
http://www.redhat.com/support/errata/RHSA-2003-404.html