CVE-2008-4572
GuildFTPd 0.999.14 - Denial of Service and Possible Remote Code Execution via Long CWD and LIST Arguments
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-4572.
PoCs published by dmnt, including Metasploit module auxiliary/dos/windows/ftp/guildftp_cwdlist.
AI-analyzed exploit summary This exploit triggers a heap corruption vulnerability in GuildFTPd by sending malformed CWD and LIST commands, leading to a denial-of-service (DoS) condition. The PoC demonstrates the vulnerability but does not include shellcode for remote code execution.
Description
GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long arguments to the CWD and LIST commands, which triggers heap corruption related to an improper free call, and possibly triggering a heap-based buffer overflow.
Exploits (2)
This exploit triggers a heap corruption vulnerability in GuildFTPd by sending malformed CWD and LIST commands, leading to a denial-of-service (DoS) condition. The PoC demonstrates the vulnerability but does not include shellcode for remote code execution.
This Metasploit module exploits a heap corruption vulnerability in Guild FTPd versions 0.999.8.11 and 0.999.14 by sending malformed CWD and LIST commands, leading to a denial-of-service condition. It requires valid FTP credentials to execute the attack.