« Volver al listado

CVE-2009-4593

Estado: ModificadaMedia (5)—

The bftpdutmp_log function in bftpdutmp.c in Bftpd before 2.4 does not place a '\0' character at the end of the string value of the ut.bu_host structure member, which might allow remote attackers to cause a denial of service (daemon crash) via unspecified vectors. NOTE: some of these details are obtained from third party information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jesse Smith — Bftpd

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-4593",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-01-07T18:30:01.057",
  "references": [
    {
      "url": "http://bftpd.sourceforge.net/downloads/CHANGELOG",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://bftpd.sourceforge.net/news.html#032130",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/37185",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/36820",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3032",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://bftpd.sourceforge.net/downloads/CHANGELOG",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://bftpd.sourceforge.net/news.html#032130",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37185",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/36820",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3032",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The bftpdutmp_log function in bftpdutmp.c in Bftpd before 2.4 does not place a '\\0' character at the end of the string value of the ut.bu_host structure member, which might allow remote attackers to cause a denial of service (daemon crash) via unspecified vectors. NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "La función bftpdutmp_log en bftpdutmp.c en Bftpd anterior a v2.4 no coloca un carácter '\\0' al final del valor de la cadena del miembro de la estructura ut.bu_host, lo que podría permitir a atacantes remotos provocar una denegación de servicio (caída del demonio) a través de vectores sin especificar. NOTA: algunos de estos detalles se han obtenido de información de terceros."
    }
  ],
  "lastModified": "2026-06-16T23:13:59.173",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jesse_smith:bftpd:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC8FFBEC-3DD2-46C1-97CF-841B5E786F6B",
              "versionEndIncluding": "2.3"
            },
            {
              "criteria": "cpe:2.3:a:jesse_smith:bftpd:1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E8E4C73-ED5C-4355-9807-EE1D3030C48E"
            },
            {
              "criteria": "cpe:2.3:a:jesse_smith:bftpd:1.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E054E20-88C2-4A9D-9BB3-003C80C2DD65"
            },
            {
              "criteria": "cpe:2.3:a:jesse_smith:bftpd:1.7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57EF91DA-1A34-4732-A792-065255DBB7B4"
            },
            {
              "criteria": "cpe:2.3:a:jesse_smith:bftpd:1.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F6F26B0-02AB-4C88-B574-7ADEDAAB50D2"
            },
            {
              "criteria": "cpe:2.3:a:jesse_smith:bftpd:2.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5206633B-42AE-495C-AA97-288B11AC4237"
            },
            {
              "criteria": "cpe:2.3:a:jesse_smith:bftpd:2.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDABF99E-DD01-4E51-87A8-833073ABC964"
            },
            {
              "criteria": "cpe:2.3:a:jesse_smith:bftpd:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEF61A07-F34F-4423-969B-5765D1C35138"
            },
            {
              "criteria": "cpe:2.3:a:jesse_smith:bftpd:2.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B495F7C4-E59F-47F6-8067-C49EB6DAEA50"
            },
            {
              "criteria": "cpe:2.3:a:jesse_smith:bftpd:2.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE9C1EED-6E77-4A57-BE88-BF784C0EE403"
            },
            {
              "criteria": "cpe:2.3:a:jesse_smith:bftpd:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CCA3340-1B0F-442E-86B6-4C48928DBA66"
            },
            {
              "criteria": "cpe:2.3:a:jesse_smith:bftpd:2.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "586833AE-18C0-435C-9DE2-CBF7461A8796"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}