CVE-2010-1938
FreeBSD 6.4-8.1-PRERELEASE - Denial of Service or Remote Code Execution via Long Username
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-1938. PoCs published by Maksymilian Arciemowicz, Nexxus67.
AI-analyzed exploit summary This PoC demonstrates an off-by-one vulnerability in FreeBSD 8.0 ftpd by sending an overly long username, causing a connection closure. It exploits a buffer overflow in the authentication process.
Description
Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long username, as demonstrated by a long USER command to the FreeBSD 8.0 ftpd.
Exploits (2)
This PoC demonstrates an off-by-one vulnerability in FreeBSD 8.0 ftpd by sending an overly long username, causing a connection closure. It exploits a buffer overflow in the authentication process.
This repository contains a functional Python exploit for CVE-2010-1938, an off-by-one vulnerability in the OPIE library affecting FTP servers. The exploit includes fuzzing capabilities, payload generation, and crash detection to test for DoS or potential RCE.