VulnerabilityModified

CVE-2004-2074

Format string vulnerability in Dream FTP 1.02 allows local users to cause a denial of service (crash) via format string specifiers in the (1) PASS or (2) RETR commands.

MEDIUM 5.0EPSS 35.8%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 35.8%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

Format string vulnerability in Dream FTP 1.02 allows local users to cause a denial of service (crash) via format string specifiers in the (1) PASS or (2) RETR commands.

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS: 35.78% probability · 98th percentile
CISA KEV: Not listed
Affected: bolintech/dream ftp server
Source: cve@mitre.org

References

http://securitytracker.com/id?1009295Exploit
http://www.securityfocus.com/bid/9800Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/15380
http://securitytracker.com/id?1009295Exploit
http://www.securityfocus.com/bid/9800Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/15380

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.