CVE-2003-0466: Buffer Overflow
Off-by-one error in the fbrealpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0466?
CVE-2003-0466 is considered to have high severity due to its potential for arbitrary code execution via buffer overflow.
How do I fix CVE-2003-0466?
To fix CVE-2003-0466, upgrade to the latest version of wu-ftpd or apply the appropriate patches provided by the distribution maintainers.
Which versions of wu-ftpd are affected by CVE-2003-0466?
CVE-2003-0466 affects wu-ftpd versions 2.5.0 to 2.6.2.
What is the nature of the vulnerability in CVE-2003-0466?
CVE-2003-0466 is an off-by-one error in the fb_realpath() function that can lead to a buffer overflow.
Can CVE-2003-0466 be exploited remotely?
Yes, CVE-2003-0466 can be exploited remotely via certain FTP commands that manipulate pathname lengths.