CVE-2003-0466

Critical

Published: 27/08/2003(UTC)Translated: 30/05/2026(UTC)NVD NIST

Summary

An off-by-one error in the fb_realpath() function may allow attackers to execute arbitrary code. The issue affects wu-ftpd versions 2.5.0 to 2.6.2 when commands cause pathnames to exceed MAXPATHLEN, leading to a buffer overflow.

Risk Assessment

Organizations using vulnerable versions of wu-ftpd may be at risk of remote code execution, posing a serious threat to system security.

Recommendation

It is recommended to upgrade to the latest version of wu-ftpd to mitigate this vulnerability and to monitor systems for unauthorized activities.

Original NVD description (English source)

Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.