CVE-2019-25611
HIGHMiniFtp parseconf_load_setting Buffer Overflow via Configuration
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25611. PoCs published by strider.
AI-analyzed exploit summary This exploit demonstrates a local buffer overflow in MiniFtp's parseconf_load_setting function, where a crafted configuration file (miniftpd.conf) triggers a stack-based overflow, leading to arbitrary code execution (shellcode). The exploit leverages a 318-byte payload with NOP sleds and shellcode to spawn a root shell.
Description
MiniFtp contains a buffer overflow vulnerability in the parseconf_load_setting function that allows local attackers to execute arbitrary code by supplying oversized configuration values. Attackers can craft a miniftpd.conf file with values exceeding 128 bytes to overflow stack buffers and overwrite the return address, enabling code execution with root privileges.
Exploits (1)
This exploit demonstrates a local buffer overflow in MiniFtp's parseconf_load_setting function, where a crafted configuration file (miniftpd.conf) triggers a stack-based overflow, leading to arbitrary code execution (shellcode). The exploit leverages a 318-byte payload with NOP sleds and shellcode to spawn a root shell.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H