CVE-2011-5166 : Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to e

Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string to the (1) USER, (2) PASS, (3) REIN, (4) QUIT, (5) PORT, (6) PASV, (7) TYPE, (8) STRU, (9) MODE, (10) RETR, (11) STOR, (12) APPE, (13) ALLO, (14) REST, (15) RNFR, (16) RNTO, (17) ABOR, (18) DELE, (19) CWD, (20) LIST, (21) NLST, (22) SITE, (23) STST, (24) HELP, (25) NOOP, (26) MKD, (27) RMD, (28) PWD, (29) CDUP, (30) STOU, (31) SNMT, (32) SYST, and (33) XPWD commands.

Published 2012-09-15 17:55:05

Updated 2017-08-29 01:30:43

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2011-5166

Elif Keir » Knftp » Version: 1.0.0
cpe:2.3:a:elif_keir:knftp:1.0.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2011-5166

EPSS FAQ

33.47%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2011-5166

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2011-5166

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-5166

http://www.exploit-db.com/exploits/17819

KnFTP Server - Remote Buffer Overflow - Windows remote Exploit
Exploit
http://archives.neohapsis.com/archives/bugtraq/2011-09/0015.html

Exploit
http://www.exploit-db.com/exploits/17856

KnFTP 1.0.0 Server - Multiple Buffer Overflows (PoC) (SEH) - Windows dos Exploit
Exploit
http://www.exploit-db.com/exploits/18089

KnFTP 1.0 - Remote Buffer Overflow (DEP Bypass) (Metasploit) - Windows remote Exploit
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/69557

KnFTPd FTP Server multiple commands buffer overflow CVE-2011-5166 Vulnerability Report
http://www.exploit-db.com/exploits/17870

KnFTP 1.0.0 Server - 'USER' Remote Buffer Overflow - Windows remote Exploit
Exploit

Jump to

Vulnerability Details : CVE-2011-5166

Products affected by CVE-2011-5166

Exploit prediction scoring system (EPSS) score for CVE-2011-5166

CVSS scores for CVE-2011-5166

CWE ids for CVE-2011-5166

References for CVE-2011-5166