📦

wu-ftpd

Vendor: wuftpd

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 9 Code Available
Total RCEs 3 Remote Access
Total CVEs 1 Total Indexed
Avg. EPSS 11.43% Exploit Prob.
Latest CVE CVE-2005-0256 May 02

Security Vulnerability Index

Page 1 / 1
5.0 CVSS
CVE-2005-0256
Exploit Found

The wu_fnmatch function in wu_fnmatch.c in wu-ftpd 2.6.1 and 2.6.2 allows remote attackers to cause a denial of service (CPU exhaustion by recursion) via a glob pattern with a large number of * (wildcard) characters, as demonstrated using the dir command.

EPSS: 26.55%
7.2 CVSS
CVE-2004-0148

wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead.

EPSS: 0.03%
10.0 CVSS
CVE-2004-0185

Buffer overflow in the skey_challenge function in ftpd.c for wu-ftp daemon (wu-ftpd) 2.6.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a s/key (SKEY) request with a long name.

EPSS: 8.59%
7.8 CVSS
CVE-2003-1329

ftpd.c in wu-ftpd 2.6.2, when running on "operating systems that only allow one non-connected socket bound to the same local address," does not close failed connections, which allows remote attackers to cause a denial of service.

EPSS: 0.65%
9.3 CVSS
CVE-2003-1327

Buffer overflow in the SockPrintf function in wu-ftpd 2.6.2 and earlier, when compiled with MAIL_ADMIN option enabled on a system that supports very long pathnames, might allow remote anonymous users to execute arbitrary code by uploading a file with a long pathname, which triggers the overflow when wu-ftpd constructs a notification message to the administrator.

EPSS: 1.36%
5.0 CVSS
CVE-2003-0853
Exploit Found

An integer overflow in ls in the fileutils or coreutils packages may allow local users to cause a denial of service or execute arbitrary code via a large -w value, which could be remotely exploited via applications that use ls, such as wu-ftpd.

EPSS: 2.44%
2.1 CVSS
CVE-2003-0854
Exploit Found

ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.

EPSS: 0.23%
9.8 CVSS
CVE-2003-0466
Exploit Found

Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.

EPSS: 90.82%
7.5 CVSS
CVE-2001-0550
RCE Exploit Found

wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which is not properly handled by the glob function (ftpglob).

EPSS: 60.88%
7.5 CVSS
CVE-2001-0935

Vulnerability in wu-ftpd 2.6.0, and possibly earlier versions, which is unrelated to the ftpglob bug described in CVE-2001-0550.

EPSS: 0.33%