National Vulnerability Database (CVE-2003-0831)

National Cyber-Alert System Vulnerability Summary: CVE-2003-0831
Orirignal release date: 2003-11-17 Source: US-CERT/NIST ### Overview ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, which allows remote attackers to execute arbitrary code via a buffer overflow using certain files. ### Impact CVSS Severity: 7 (High) Range: remote Authentication: input buffer="1" Impact Type: sec_prot other="1" ### Reference to Advisories, Solutions, and Tools External Source: Security Focus Name: BID: 8679 Hyperlink: http://www.securityfocus.com/bid/8679 External Source: The Aims Group Name: m=106441655617816& Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: ISS X-Force Name: ProFTPD ASCII file newline buffer overflow Hyperlink: http://xforce.iss.net/xforce/xfdb/12200 External Source: ISS Name: 20030923 ProFTPD ASCII File Remote Compromise Vulnerability Hyperlink: http://xforce.iss.net/xforce/alerts/id/154 External Source: BUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: BUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: FULLDISC Name: 20031014 Another ProFTPd root EXPLOIT ? Hyperlink: http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012072.html External Source: MANDRAKE Name: MDKSA-2003:095 Hyperlink: http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:095 External Source: CERT-VN Name: VU#405348 Hyperlink: http://www.kb.cert.org/vuls/id/405348 External Source: SECUNIA Name: 9829 Hyperlink: http://secunia.com/advisories/9829 ### Vulnerable Software and Vendor ProFTPD (ProFTPD Project) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0831