CVE-2010-20122: Xftp FTP Client <= 3.0 PWD Response Buffer Overflow
Xftp FTP Client version up to and including 3.0 (build 0238) contain a stack-based buffer overflow vulnerability triggered by a maliciously crafted PWD response from an FTP server. When the client connects to a server and receives an overly long directory string in response to the PWD command, the client fails to properly validate the length of the input before copying it into a fixed-size buffer. This results in memory corruption and allows remote attackers to execute arbitrary code on the client system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-20122?
CVE-2010-20122 is classified as having a high severity due to its potential to allow remote code execution through a buffer overflow.
How do I fix CVE-2010-20122?
To fix CVE-2010-20122, users should upgrade the Xftp FTP Client to version 3.0 build 0239 or later, which addresses the vulnerability.
What type of vulnerability is CVE-2010-20122?
CVE-2010-20122 is a stack-based buffer overflow vulnerability triggered by maliciously crafted PWD responses from an FTP server.
Which versions of the Xftp FTP Client are affected by CVE-2010-20122?
CVE-2010-20122 affects all versions of the Xftp FTP Client up to and including version 3.0 build 0238.
What can an attacker achieve by exploiting CVE-2010-20122?
By exploiting CVE-2010-20122, an attacker could potentially execute arbitrary code on the client, leading to system compromise.