CVE-2019-25686

Core FTP 2.0 build 653 PBSZ Unauthenticated Denial of Service

CVSS 8.7 HIGHEPSS 0.5%CWE-306

Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a malformed command with an oversized buffer. Attackers can send a PBSZ command with a payload exceeding 211 bytes to trigger an access violation and crash the FTP server process.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products

Coreftp · Core FTP

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/46532unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://coreftp.com/server/download/archive/CoreFTPServer653.exe https://www.exploit-db.com/exploits/46532 https://www.vulncheck.com/advisories/core-ftp-build-653-pbsz-unauthenticated-denial-of-service http://www.coreftp.com/