CVE-2014-0603
The rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to cause a denial of service (memory corruption) and execute arbitrary code via vectors related to the (1) GetGlobalSettings or (2)…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to cause a denial of service (memory corruption) and execute arbitrary code via vectors related to the (1) GetGlobalSettings or (2) GetSiteProperties3 methods, which triggers a dereference of an arbitrary memory address. NOTE: this issue was MERGED with CVE-2014-0606 because it is the same type of vulnerability, affecting the same set of versions, and discovered by the same researcher.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 5.67% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- attachmate/reflection ftp client
- Source
- cve@mitre.org
References
- http://support.attachmate.com/techdocs/2501.htmlVendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-14-288/
- http://www.zerodayinitiative.com/advisories/ZDI-14-291/
- http://support.attachmate.com/techdocs/2501.htmlVendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-14-288/
- http://www.zerodayinitiative.com/advisories/ZDI-14-291/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.