CVE-2003-0466
- State
- Published
- Severity
- Not scored
- Published
- Aug 1, 2003
- Updated
- Aug 8, 2024
- Reserved
- Jun 26, 2003
Description
Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20030804 Off-by-one Buffer Overflow Vulnerability in BSD libc realpath(3)mailing-list
- http://isec.pl/vulnerabilities/isec-0011-wu-ftpd.txt
- 9446third-party-advisory
- 6602vdb-entry
- oval:org.mitre.oval:def:1970vdb-entrysignature
- 20060213 Latest wu-ftpd exploit :-smailing-list
- 8315vdb-entry
- 9423third-party-advisory
- 20030731 wu-ftpd fb_realpath() off-by-one bugmailing-list
- 20030731 wu-ftpd fb_realpath() off-by-one bugmailing-list
- IMNX-2003-7+-019-01vendor-advisory
- RHSA-2003:246vendor-advisory
- 20060214 Re: Latest wu-ftpd exploit :-smailing-list
- VU#743092third-party-advisory
- RHSA-2003:245vendor-advisory
- SuSE-SA:2003:032vendor-advisory
- 1001257vendor-advisory
- DSA-357vendor-advisory
- 20030804 wu-ftpd-2.6.2 off-by-one remote exploit.mailing-list
- 1007380vdb-entry
- MDKSA-2003:080vendor-advisory
- libc-realpath-offbyone-bo(12785)vdb-entry
- FreeBSD-SA-03:08vendor-advisory
- TLSA-2003-46vendor-advisory
- 9535third-party-advisory
- 9447third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.