Vulnerability Details : CVE-2020-5204
In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correct for valid IPv4 addresses (len('255.255.255.255') == 16), but the format specifier %d allows more than 3 digits. This has been fixed in version 2.11
Vulnerability category: Overflow
Products affected by CVE-2020-5204
- cpe:2.3:a:troglobit:uftpd:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-5204
0.69%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 70 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-5204
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L |
2.3
|
3.7
|
GitHub, Inc. |
CWE ids for CVE-2020-5204
-
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.Assigned by: nvd@nist.gov (Primary)
-
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).Assigned by: security-advisories@github.com (Secondary)
References for CVE-2020-5204
-
https://github.com/troglobit/uftpd/commit/0fb2c031ce0ace07cc19cd2cb2143c4b5a63c9dd
FTP: Fix buffer overflow in PORT parser, reported by Aaron Esau · troglobit/uftpd@0fb2c03 · GitHubPatch;Third Party Advisory
-
https://github.com/troglobit/uftpd/security/advisories/GHSA-wrpr-xw7q-9wvq
Buffer Overflow · Advisory · troglobit/uftpd · GitHubThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00034.html
[security-announce] openSUSE-SU-2020:0069-1: important: Security update
Jump to