CVE-2003-0466 : Off-by-one error in the fb_realpath() function, as derived from the realpath fun

Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.

Published 2003-08-27 04:00:00

Updated 2025-04-03 01:03:51

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2003-0466

SUN » Solaris » Version: 9.0 For Sparc
cpe:2.3:o:sun:solaris:9.0:*:*:*:*:sparc:*:*
Matching versions
Freebsd » Freebsd
Versions from including (>=) 4.0 and up to, including, (<=) 5.0
cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
Matching versions
Redhat » Wu Ftpd » Version: 2.6.1-16
cpe:2.3:a:redhat:wu_ftpd:2.6.1-16:*:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.2.6
cpe:2.3:o:apple:mac_os_x:10.2.6:*:*:*:*:*:*:*
Matching versions
Apple » Mac Os X Server » Version: 10.2.6
cpe:2.3:o:apple:mac_os_x_server:10.2.6:*:*:*:*:*:*:*
Matching versions
Netbsd » Netbsd
Versions from including (>=) 1.5 and up to, including, (<=) 1.6.1
cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:*
Matching versions
Openbsd » Openbsd
Versions from including (>=) 2.0 and up to, including, (<=) 3.3
cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*
Matching versions
Wuftpd » Wu-ftpd
Versions from including (>=) 2.5.0 and up to, including, (<=) 2.6.2
cpe:2.3:a:wuftpd:wu-ftpd:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2003-0466

EPSS FAQ

90.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2003-0466

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST	2024-02-08
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2003-0466

CWE-193 Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2003-0466

http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0065.html

Broken Link;Exploit;Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2003-246.html

Support
Broken Link
http://securitytracker.com/id?1007380

Broken Link;Third Party Advisory;VDB Entry
http://marc.info/?l=bugtraq&m=105967301604815&w=2

'wu-ftpd fb_realpath() off-by-one bug' - MARC
Mailing List
http://secunia.com/advisories/9447

About Secunia Research | Flexera
Broken Link
http://marc.info/?l=bugtraq&m=106001702232325&w=2

'wu-ftpd-2.6.2 off-by-one remote exploit.' - MARC
Mailing List
http://secunia.com/advisories/9423

About Secunia Research | Flexera
Broken Link
http://download.immunix.org/ImmunixOS/7+/Updates/errata/IMNX-2003-7+-019-01

Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1970

404 Not Found
Broken Link
http://secunia.com/advisories/9446

About Secunia Research | Flexera
Broken Link
http://www.securityfocus.com/archive/1/424852/100/0/threaded

Broken Link;Third Party Advisory;VDB Entry
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1001257.1-1

Broken Link
http://www.debian.org/security/2003/dsa-357

Debian -- The Universal Operating System
Broken Link
http://www.turbolinux.com/security/TLSA-2003-46.txt

404 Not Found
Broken Link
http://www.novell.com/linux/security/advisories/2003_032_wuftpd.html

404 Page Not Found | SUSE
Broken Link
http://www.kb.cert.org/vuls/id/743092

VU#743092 - realpath(3) function contains off-by-one buffer overflow
Third Party Advisory;US Government Resource
http://secunia.com/advisories/9535

About Secunia Research | Flexera
Broken Link
http://isec.pl/vulnerabilities/isec-0011-wu-ftpd.txt

Broken Link
http://marc.info/?l=bugtraq&m=106001410028809&w=2

'FreeBSD Security Advisory FreeBSD-SA-03:08.realpath' - MARC
Mailing List
http://www.mandriva.com/security/advisories?name=MDKSA-2003:080

Advisories - Mandriva Linux
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/12785

libc realpath(3) function off-by-one buffer overflow CVE-2003-0466 Vulnerability Report
Third Party Advisory;VDB Entry
http://marc.info/?l=bugtraq&m=106002488209129&w=2

'Off-by-one Buffer Overflow Vulnerability in BSD libc realpath(3)' - MARC
Mailing List
http://www.securityfocus.com/archive/1/425061/100/0/threaded

Broken Link;Third Party Advisory;VDB Entry
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-011.txt.asc

Broken Link
http://www.osvdb.org/6602

404 Not Found
Broken Link
http://www.redhat.com/support/errata/RHSA-2003-245.html

Support
Broken Link
http://www.securityfocus.com/bid/8315

Broken Link;Exploit;Patch;Third Party Advisory;VDB Entry;Vendor Advisory

Jump to

Vulnerability Details : CVE-2003-0466

Products affected by CVE-2003-0466

Exploit prediction scoring system (EPSS) score for CVE-2003-0466

CVSS scores for CVE-2003-0466

CWE ids for CVE-2003-0466

References for CVE-2003-0466