Signature Detail
Short Name |
FTP:VULN:SERVU-FTP-BO |
|---|---|
Severity |
Medium |
Recommended |
No |
Category |
FTP |
Keywords |
ServU Timezone MDTM Buffer Overflow |
Release Date |
2005/01/28 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
FTP: ServU Timezone MDTM Buffer Overflow
This signature detects RhinoSoft Serv-U FTP 4.3 and earlier. These versions contain a buffer overflow vulnerability in the MDTM command that enables attackers to execute malicous code on a remote server.
Extended Description
Serv-U FTP Server has been reported prone to a remote stack based buffer overflow vulnerability when handling time zone arguments passed to the MDTM FTP command. The problem exists due to insufficient bounds checking. Ultimately an attacker may leverage this issue to have arbitrary instructions executed in the context of the SYSTEM user.
Affected Products
- Rhino Software Serv-U 3.0.0
- Rhino Software Serv-U 3.1.0
- Rhino Software Serv-U 4.0.0 .0.4
- Rhino Software Serv-U 4.1.0
- Rhino Software Serv-U 4.1.0 .0.11
- Rhino Software Serv-U 4.2.0
References
- BugTraq: 9751
- CVE: CVE-2004-0330
- URL: http://www.serv-u.com/
- URL: http://www.securityfocus.com/archive/1/355537