CVE

Id
2150  
CVE No.
CVE-2000-0574  
Status
Candidate  
Description
FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function (sometimes called by set_proc_title), which allows remote attackers to cause a denial of service or execute arbitrary commands.  
Phase
Proposed (20000719)  
Votes
ACCEPT(3) Cole, Levy, Magdych | MODIFY(1) Frech | NOOP(2) LeBlanc, Wall | REVIEWING(1) Christey  
Comments
Christey> CD:SF-CODEBASE applies here. There are many ftpd"s that | have this setproctitle() problem, but it might be traced | back to the same codebase. See if the HP problem is the | same here as well, and if so, ADDREF HP:HPSBUX0007-117 | URL:http://www.securityfocus.com/templates/advisory.html?id=2404 | Frech> XF:ftp-setproctitle-format-string(4908) | BID:1438 does not exist. | Christey> ADDREF HP:HPSBUX0007-117?? | http://archives.neohapsis.com/archives/hp/2000-q4/0020.html | Christey> ADDREF BID:650 ?  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
7478 2150 CVE-2000-0574 BUGTRAQ:20000705 proftp advisory  View
7479 2150 CVE-2000-0574 URL:http://archives.neohapsis.com/archives/bugtraq/2000-07/0031.html  View
7480 2150 CVE-2000-0574 BUGTRAQ:20000706 ftpd and setproctitle()  View
7481 2150 CVE-2000-0574 URL:http://archives.neohapsis.com/archives/bugtraq/2000-07/0061.html  View
7482 2150 CVE-2000-0574 CERT:CA-2000-13  View
7483 2150 CVE-2000-0574 URL:http://www.cert.org/advisories/CA-2000-13.html  View
7484 2150 CVE-2000-0574 BUGTRAQ:20000710 opieftpd setproctitle() patches  View
7485 2150 CVE-2000-0574 URL:http://archives.neohapsis.com/archives/bugtraq/2000-07/0121.html  View
7486 2150 CVE-2000-0574 NETBSD:NetBSD-SA2000-009  View
7487 2150 CVE-2000-0574 URL:ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/advisories/NetBSD-SA2000-009.txt.asc  View
7488 2150 CVE-2000-0574 BID:1425  View
7489 2150 CVE-2000-0574 URL:http://www.securityfocus.com/bid/1425  View
7490 2150 CVE-2000-0574 BID:1438  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
64268 JVNDB-2000-000048 ProFTPD の setproctitle() 関数におけるフォーマットストリングの脆弱性 ProFTPD および、それらを元に派生した ftpd の setproctitle() 関数には、Anonymous ログイン時にパスワードとして "%" 文字が指定された場合、フォーマットストリングとして扱ってしまう脆弱性が存在します。 CVE-2000-0574 2150 5 http://jvndb.jvn.jp/ja/contents/2000/JVNDB-2000-000048.html  View