CVE-2004-0159

Format string vulnerability in hsftp 1.11 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via file names containing format string characters that are not properly handled when executing an "ls" command.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2004-03-15

Last modified

2024-08-08

Affected products

• Hsftp (Samhain Labs)

References

• http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/017737.html
• http://www.osvdb.org/4029
• http://www.securityfocus.com/bid/9715
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15276
• https://www.debian.org/security/2004/dsa-447