CVE-2004-0346: Buffer Overflow
Published Mar 18, 2004
·Updated
Off-by-one buffer overflow in xlateasciiwrite() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.
Affected Software
8 affected components
Proftpd Project Proftpd=1.2.9_rc2
Proftpd Project Proftpd=1.2.7
Proftpd Project Proftpd=1.2.9_rc1
Proftpd Project Proftpd=1.2.8
ProFTPD ProFTPD>=1.2.7<1.2.9
ProFTPD ProFTPD=1.2.9
ProFTPD ProFTPD=1.2.9-rc1
ProFTPD ProFTPD=1.2.9-rc2
Event History
Mar 18, 2004
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0346?
CVE-2004-0346 is considered to have a medium severity due to the potential for privilege escalation by local users.
2
How do I fix CVE-2004-0346?
To mitigate CVE-2004-0346, upgrade ProFTPD to version 1.2.9 or later.
3
What versions of ProFTPD are affected by CVE-2004-0346?
CVE-2004-0346 affects ProFTPD versions 1.2.7 through 1.2.9-rc2.
4
Who is at risk for CVE-2004-0346?
Local users on systems running vulnerable versions of ProFTPD may exploit CVE-2004-0346 to gain elevated privileges.
5
What is the nature of the vulnerability in CVE-2004-0346?
CVE-2004-0346 is an off-by-one buffer overflow vulnerability in the _xlate_ascii_write() function.